6/06/2024
The National Data Protection Authority (ANPD) recently conducted a webinar to introduce a new guideline on the concept of high-risk and large-scale personal data processing (Guide) – which is still in the consultation phase, as we will see below.
Considering the significant impact these definitions can have on organizational operations and responsibilities, as well as the need to comply with the General Data Protection Law (LGPD), it is essential to continuously monitor the guidelines and directives provided by the ANPD. This initiative allows organizations to anticipate changes and prepare adequately.
Below, it is present a summary of the main points discussed during the webinar, providing valuable insights for companies, especially for those that understand the importance of mitigating potential risks and the competitive advantage in the market by earning the trust of their consumers and business partners.
Article 4, paragraph 3 of the Regulation for the Application of the LGPD by “Small-Scale Data Processing Agents” (ATPP), approved by ANPD Resolution No. 2, dated January 27, 2022, establishes that the ANPD may provide guidelines and guidance to support the assessment of situations representing high risk in the processing of personal data. In this context, the Guide presented in the webinar, currently in the public consultation phase, seeks to clarify this concept and highlight its importance, not only for ATPPs but also in other situations, such as assessing the severity of violations and reporting security incidents.
The Guide provides both objective and subjective parameters to define what constitutes high-risk data processing. These factors include the number of data subjects involved, data volume, duration, frequency, and geographic extent of processing. The proposed methodology, which employs a mathematical formula with assigned weights for each criterion, was presented to assess whether a processing activity is considered high risk.
Furthermore, the general criteria (large-scale processing and the potential to significantly affect rights) and specific criteria (use of emerging technologies, surveillance of public areas, automated decision-making, sensitive data, data of children/adolescents, and the elderly) that constitute high risk in personal data processing were detailed.
The definition of high risk, therefore, is a topic that generates relevant debates, especially in a scenario characterized by the rapid development of innovative technologies that, while offering benefits, also create significant challenges to privacy and the rights of data subjects. It is already known that the following situations certainly fall into this category:
- Continuous monitoring of individuals’ activities in public spaces (e.g., surveillance by cameras).
- Large-scale processing of health data.
- Analysis of genetic or biometric data for the unique identification of an individual.
- Behavioral profiling that can significantly affect individuals’ rights and freedoms, such as credit scoring or performance analysis at work.
The Guide will bring practical examples of situations where personal data processing is considered high risk will be provided. In its draft, one example is the processing of personal data on a large scale that includes sensitive data or data of children and adolescents, such as in hemodialysis procedures. Another example referenced by the Authority is the use of emerging technologies, such as artificial intelligence algorithms, to make automated decisions that can have a significant impact on individuals’ lives. The processing of banking information, which can lead to identity theft and financial fraud, is also considered high risk. These examples illustrate the necessity of implementing appropriate security measures to safeguard personal data and the rights of data subjects.
In light of these challenges, the ANPD has initiate a public consultation process to request input that will inform the development and enhancement of guidelines on this matter. The Guide presented during the webinar is open for public consultation until May 31st. We encourage all stakeholders to participate in order to enhance understanding of high-risk situations and promote the adoption of best practices in personal data processing.
The Privacy and Data Protection team from LO Baptista is available to here.
Authored by: Denise de Araujo Berzin Reupke
