On 09/04/2019, the first public hearing of the Joint Committee of Provisional Act 869/18 ("MP 869/18") was held to discuss the topic "National Data Protection Authority: institutional design and models of governance, competencies and attributions for a National Data Protection Policy". Representatives of the Special Secretariat for Digital Debureaucratization, Management and Government of the Ministry of the Economy participated in the debate; the Coalition of Rights on the Internet; the Sub-office for Legal Affairs of the Civil House of the Presidency of the Republic; the academy, represented by the University of Brasilia; the Brazilian Association of Direct Marketing - ABEMD; the National Confederation of Industry - CNI and members of the Brazilian Bar Association.
During the hearing, the central discussion addressed the need for technical, functional and financial autonomy of the National Data Protection Agency ("ANPD"), with different opinions on the subject. Most participants argued for the importance of having an independent Personal Data Protection Authority, in compliance with international standards on the subject, like the Organization for Economic Cooperation and Development (OECD) guidelines and International Protection Conventions on Personal Data, and also in accordance with the complexity required by the General Data Protection Law ("LGPD"), in order to avoid Brazil being included in the well-known "hall of shame" of data protection.
It is important to mention that members of the government have come to assume that the ANPD functional model of MP 869/18 - which treats the agency as a Federal Public Administration agency, part of the Presidency of the Republic - is not ideal, but stressed that it is the possible solution for the moment, due to the short timetable for analysis of the Provisional Act. In addition, they cited, as an example to be followed, the case of the Administrative Council for Economic Defense (CADE), which was created as an appendage to the Ministry of Justice and which, over the years, became an autarchy. They also reinforced the possibility of transforming the entity into an autarchy within 1 (one) year, if the ANPD is created in time to enter the 2020 budget schedule, guaranteeing its financial autonomy.
The Rapporteur of the Joint Committee stressed the economic importance of resolving the issue and the seriousness of treating the ANPD as an independent authority in order to avoid the profusion of local standards to address the problem. The academy, represented by the University of Brasília, adhered to the position in defense of the autonomy of the agency, upholding the need of a lean legal model for the autarchy, so that it does not necessarily generate more costs than Direct Administration; and raised the analysis of unconstitutionality due to the change in the legal nature of the ANPD. Finally, other important issues raised were the need for differentiated treatment of micro, small and medium-sized enterprises and the inconsistency of a 5 (five) person board to oversee regulatory agencies and large agencies such as the Judiciary and Ministry of Health.
The second public hearing of the Joint Committee of MP 869/18 was held on April 10, 2019, which discussed the topic "Data processing by Public Administration and Protection of data related to defense and public security", with special attention to flexibility in the transfer and sharing of data with private entities when controlled by Public Authorities and suppression of the possibility of the ANPD to express opinions on the processing of data carried out by security entities and to request impact reports on protection. The debates brought together the Counterintelligence General Coordination of the Secretariat of Integrated Operations of the Ministry of Justice and Public Security; the Public Ministry of the Federal District; the Academy; the National Forum for Democratization of Communication and the Strategic Coordination of Security Management of Serpros Information Assets.
At that time, emphasis was mainly placed on the need for symmetrical regulation of the public and private sectors. This is because the changes introduced by MP 869/18 have made the states obligations more flexible, reducing transparency mechanisms and creating greater permissibility of data sharing between public and private entities. The egalitarian regulation of the Public and Private Authority consists of international standards, being present in the OECD and European Convention guidelines, as well as internal regulations, and in the constitutional principles of transparency, efficiency, publicity, legality and morality, which impose such responsibilities on the State. According to the representative of the National Forum for Democratization of Communication, there is an asymmetry between the Public Authority and citizens, which generates a need for greater responsibility on the part of the first to avoid deviations of purpose in the use of data. Thus, most of the participants statements were due to the obligation of the Government to comply fully with the rules of the LGPD, being subject, even, to the configuration of administrative improbability if it does not do so.
Regarding the issue of the relationship between personal data and national security, it is interesting to note that the representative of the Ministry of Justice expressed the need to establish the ANPD so that it is responsible for regulating the operation of strategic data and sensitive to national security, so as to avoid their defenselessness and vulnerability to organized crime. The Public Ministry of the Federal District and Territories has declared that it is contrary to the attribution of responsibility to the ANPD to deal with issues of national security, since it is a civil agency; however, it believes that the Authority should regulate the processing of data entered in criminal investigations, since, for that, it is necessary to exchange information with other countries, something that could be improved by the existence of a consistent regulatory framework.
Other relevant issues raised were the excessive amplitude of ANPD on all sectors of the economy, which generates great responsibility in modulating rules for companies of different sizes, paying attention to a differentiated and non-egalitarian treatment for micro, small, medium and big companies. Finally, the importance of an independent national authority to ensure impartial oversight of the public sector was stressed.
Both public hearings provided an interactive system, through the links a and b, where citizens can contribute questions and opinions, which can even be read and clarified during the live broadcast.
Finally, although many solutions were suggested by the participants, there are still several doubts about MP 869/18 unfolding. Azevedo Settes Telecommunications, Media and Technology team attended the Public Hearing on April 16 to follow the debates on "Data processing in the private sector, automated treatment and the Right to Explanation", and also participated in discussions behind the scenes of the National Congress.
The next and last hearing will take place this afternoon, April 17, so that we will await continuation of the debates and the contributions of various sectors of society.
São Paulo, April 17, 2019
TMT Team of Azevedo Sette Advogados
Ricardo Barretto Ferreira
Juliana Sene Ikeda
Lorena Pretti Serraglio
Vitor Koketu
Isabella Aragão