By: Leonardo Neri
With elections in the year 2022 and the increased use of digital tools by society, the Orientative Guide for the application of LGPD by treatment agents in the electoral context was made available, aiming to create harmony between the ANPD and the TSE for better formulation and transparency of subjects’ data.
Formatted in the year 2021, the Orientation Guide on electoral issues was made available in early 2022 not only by coincidence, since it is an election year in the country, and with the increased access to information by virtual means, it is necessary that citizens have transparency and security about their personal data in this decisive moment that involves the nation’s political future.
Thus, for a better understanding, the manual has been explaining in a cohesive way the main legal bases of the General Law of Data Protection, the LGPD. These are: Consent to the use of personal data, contained in Article 7, item I, and Article 11, item I. The Legal Obligation, detailed in Article 7, item II and Article 11, item II, a; and finally, the Legitimate Interest of the Controller or Third Party, expressed in greater detail in Article 7, item IX of the same law.
It is also worth pointing out that it is demonstrated how to use the principles of necessity, adequacy and purpose for the legitimate treatment of sensitive personal data. Furthermore, it is explained in an exemplary manner how to avoid the purpose misuse in the personal data treatment. Let’s see:
After fulfilling its function. The personal data processing is finalized and closed, and these data cannot be used for purposes incompatible with the original legal basis that gave legitimacy to the data processing operation. As a rule, therefore, personal data that does not fit a respective legal basis must be deleted or anonymized, as expressed in the LGPD body itself.
When evaluating the personal data use context in the electoral environment, it will be of paramount importance to monitor the accountability principle. This principle emphasizes that the responsible entity for personal data processing must offer documents that prove the risks mitigation for a particular risky operation put into practice by a decision under the responsibility of the company or public entity itself. Such is the case of the Privacy Governance Program (PGP), which is included in article 50, §2, clause I of the LGPD. In addition to complying with the guidelines covered in the LGPD principles, as well as in the legal bases presented above, there is also the entities obligation to establish a record of personal data processing operations demonstrated in article 37 of the LGPD, which in practice we call data inventory.
Another point of utmost importance are the channels through which the right holder must seek to fully exercise the transparency and free access principles, either by accessing the application, websites, e-mail or any digital form that is directly linked to the channel in which the holder offered his data.
Subsequently, and no less essential, it was disclosed how the entities must prevent and provide security on the personal information acquired, through information security policies, specialized training, contract management, access control and password management, storage and communication security, as well as of institutional programs routine maintenance, etc.
Finally, data protection must be interpreted by the electoral legislation in a practical way through joint and coordinated action between the National Data Protection Authority (ANPD) and the TSE, with legitimate use of the database collected prior to the LGPD, as well as the assignment, donation and sale of databases, instant electronic messages sending and content boosting.
Source: https://www.gov.br/anpd/pt-br/assuntos/noticias/guia_lgpd_final.pdf