Central Bank publishes Resolution on information security incidents involving personal data in the PIX system
Last week, the Brazilian Central Bank (BACEN) published the Resolution 347 of September 26, 2023, which established the need of financial institutions to report security incidents involving personal data to data subjects. This Resolution establishes obligations and penalties for regulated institutions participating in the PIX arrangement regarding non-compliance with security requirements and the occurrence of incidents involving personal data.
The duty to notify account holders (natural persons) arises from the occurrence of any incident involving their personal data in databases related to the PIX infrastructure. Therefore, reporting is mandatory in cases where PIX’s database is involved, even if the financial or payment institution that is the participant providing the account is not responsible for the incident.
It is worth mentioning that the provisions of Bacen Resolution 347/2023 on security incidents are stricter than the provisions of the General Data Protection Law (Law No. 13,709/2018 – “LGPD”) regarding the same matter. This is because the Resolution establishes the obligation to communicate the incident to the data subject even if the incident does not entail a relevant risk or damage to the data subject, while under the LGPD, communication of the security incident is only mandatory if there is a risk or damage to the data subject.
The Resolution 347/2023 also establishes penalties for PIX institutions that do not meet the technical security requirements established. The penalties vary, among other factors, according to the consequences of the incident, the measures adopted by the participating institution to contain and minimize the effects of the incident, the type of institution affected, and the number of PIX keys potentially compromised by the incident.
The Resolution is already in force and its text can be accessed here.
If you wish to obtain more information on this matter, we are available at email@example.com.
Last related news
February 1, 2024
Betting Market and the Creation of the Secretariat of Prizes and Bets by Decree 11.907/2024
On Wednesday, January 31, 2024, Decree No. 11.907/2024 was published in the Official Gazette, creating the Secretariat of Prizes and Bets (SPA) … Betting Market and the Creation of the Secretariat of Prizes and Bets by Decree 11.907/2024
January 19, 2024
New Law expands Ancine’s role in the fight against piracy of audiovisual content
The enactment of Law No. 14,815 on January 16 of this year marks a significant milestone in the fight against piracy of … New Law expands Ancine’s role in the fight against piracy of audiovisual content
January 9, 2024
Decree regulates the free provision of cannabidiol-based medications by the Unified Health System of São Paulo
On December 26, 2023, Decree No. 68,233/2023 was published in the Official Gazette of São Paulo, regulating the free provision of cannabidiol … Decree regulates the free provision of cannabidiol-based medications by the Unified Health System of São Paulo