LGPD · · Davi Netto
LGPD: your 8 rights as a consumer
The 8 rights Brazil's data protection law (LGPD) gives you over your personal data, and how companies must handle each type of data.
The LGPD, or Lei Geral de Proteção de Dados (Brazil’s General Data Protection Law), gives a series of rights to any individual, Brazilian or not, within Brazil. Knowing your rights is the first step to making sure Brazilian companies take the law seriously. Here are your main rights as a consumer:
1. Confirmation
Any company whose operations extend to Brazil is required to confirm whether it processes your personal information. It can’t hide that it holds such information.
2. Access
The company must give data subjects access to their personal information.
3. Correction
You can ask the company to correct incomplete, wrong or outdated data.
4. Anonymization, blocking or deletion
To comply with the law, the company must anonymize, block or delete excessive or unnecessary data.
It makes no sense for your bank to store data about your political views, or for an online store to process data about its customers’ blood types, for example. No, your pharmacy and your supermarket don’t need your CPF (Brazilian taxpayer number) to sell you a product.
5. Portability
When you switch service providers, you can ask for your data to be ported to another provider of services or products, subject to the exceptions in the law, such as trade and industrial secrets.
6. Deletion
The data subject can ask for their personal information to be deleted, except in the cases set out in article 16 of the LGPD.
7. Information
The company must tell you the consequences of not providing the personal information it asks for.
8. Withdrawal
You can, at any time, withdraw consent you gave before.
What are the penalties if a company doesn’t comply with the LGPD?
The penalties and fines vary according to the amount of data exposed, the number of people affected and, of course, how sensitive the information is. Personal data can be classified as:
Anonymized data
Data that can’t be linked to an individual.
Pseudonymized data
Information that has to be matched against a second database to be linked to an individual. A good example is a license plate, which can be traced to a person if matched against the database of DETRAN-MG (the vehicle registry of the state of Minas Gerais).
Personal data
Information that can easily be attributed to a person, such as more unique and specific names, CPF, ID card numbers and so on.
Sensitive data
Information such as blood type, racial origin, sexual orientation, medical and genetic data, union membership, biometric data, health conditions, beliefs, political opinions and data about minors under 18.
The more sensitive the information, the more care must be taken to protect and handle that data within the company.
