ANPD in the spotlight: Brazilian Data Protection Authority approves Regulation about the DPO and discloses new platform for data subject’s requests

Regulation for Data Protection Officer’s Practice

This week (Tuesday, 16), the Brazilian Data Protection Authority (ANPD) approved the Resolution CD/ANPD No. 18, which frames the Regulation of the Data Protection Office’s (DPO) practice in Brazil. The aim is “stablish complementary rules about the pointing, definition, attributions and practice of the DPO”, in complement to the Brazilian Data Protection Regulation (Law No. 13,709/2018, known as “LGPD”).

Among the obligations of the controllers and processors, are included:

– designation of the DPO through a formal act (written document, with date and signature, which should be submitted to the Authority upon request)

– stablish the necessary qualification for the DPO to act in name of the company (e.g., based on practice area, data flow etc.)

– public disclosure of DPO’s identity, whether it is an individual or a company (full name or company name)

On the other hand, the DPO must be able to communicate with the data subjects and ANPD clearly and in Brazilian Portuguese. The enrollment in associations/entities and obtention of certificates are not due. The DPO also has its own activities defined:

– accept complaint and communications from data subjects, clarify them and act accordingly

– receive communications from ANPD and act accordingly

– guide employees and hired personnel of the controllers/processors regarding acts to be taken related to data protection

– perform any other duties determined by the controllers/processors or the law

Among other tasks, there are also specific dispositions stipulating that the DPO should avoid conflicts of interest in its practice.

This is a giant stride for ANPD, since it brings more detailing to the important figure that is the DPO, created by Brazilian Law and already existent in several companies that process personal data.

New Platform to attend Data Subject’s Requests

A new platform for attending data subject’s requests was recently launched by ANPD (Monday, 8). This service allows that Brazilian citizens send claims regarding data protection violations through the Federal Government portal (GOV.BR), which is already used by approximately 150 million Brazilians. This release is a milestone for ANPD, as a modernization measure of the services rendered to data subjects. It also offers a more fluid experience to the users.

In order to guarantee a smooth transition and avoid interruptions, the old method (through SEI – Information Electronic System) will keep functioning. This will allow data subjects to become acquainted with the new platform and allow eventual inconsistencies to be identified and solved properly.

Our Digital Law team is closely monitoring all developments on this matter and its impacts on the Brazilian landscape. If you wish to receive more information on the topic, we are available via email at digital@kasznarleonardos.com.