By: Leonardo Neri
Published on 28/01/2022 the new regulation on the small-sized agents treatment, which addresses the risks and possible exemptions and obligations´ flexibilizations set out in the order.
It was published on 28/01/2022, in the DOU [Official Gazette of the Union], the approval of the treatment regulation for small-sized agents in relation to the General Law of Data Protection (LGPD). Based on the rules provided in Articles 55-J, XVIII, of Law No. 13,709; Article 2, XVIII, Annex I of Decree No. 10,474; Article 5, I, of the Internal Rules of the ANPD, decided by the Board of Directors of the National Data Protection Authority, giving rise to the following order.
This regulation presents the General Provisions, followed by Chapter 1, as well as the Preliminary Provisions: Stating that this regulation does not apply to thepersonal data processing, performed by natural persons for private, non-economic purposes, as well as for any situation that adheres to Article 4 of the LGPD.
The next chapter seeks to define which ones are directly affected on the regulation definition. They are: Micro and Small Companies; Startups; Natural Persons and unpersonalized private entities that perform personal data processing, among others. They may not benefit from differentiated legal treatments foreseen in this regulation, such as (carrying out high-risk treatment for individuals; earning gross revenues exceeding the limit established in art. 3, II of Complementary Law no. 123, of 2006 (R$360,000.00 and; belonging to an economic group whose global revenues exceed the limits of R$360,000.00).
Next, classified as High Risk Processing, will be considered the personal data processing on a large scale (significant number of data subjects); emerging and/or innovative technologies; surveillance or control of areas accessible to the public; decisions taken based on the personal data automated processing (including those intended to define the personal, professional, health, consumption, credit, or personality data subject aspects), or even concerning the use of sensitive personal data, of children, adolescents, and the elderly.
It is necessary for the small processing agent to make available personal data information, either electronically, in print or any other means assured by the LGPD.
Across the same lines, the processing activities records must follow the standards contained in article 37 of the LGPD. Furthermore, in relation to the security incidents communication, it is worth mentioning that the ANPD will make it more flexible for small-sized agents.
It is also important to point out that the aforementioned companies are not obliged to appoint a Personal Data Handling Officer; however, they will need to provide a communication channel to attend to the data subjects. However, if they choose to appoint a Data Controller, this will be considered good practice.
In another topic, it is worth mentioning that in this new regulatory environment, the deadlines will be simplified, to 15 days.
Finally, the final provisions deal with the fact that the ANPD may order the small -sized data processing agent to comply with the obligations exempted or eased in these regulations, taking into consideration immense relevance circumstances, such as the operational volume nature of the data processing being evaluated.
Source: https://in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-2-de-27-de-janeiro-de-2022-376562019