Member Article

Data protection and privacy laws are relevant to current responses aimed at preventing the spread of the coronavirus. An important response to limit the spread of the infection is the practice of identifying and monitoring anyone who may have been in contact with an infected person. This necessarily involves obtaining and potentially sharing personal information, including data about an individual's health, which is considered sensitive personal data, as well as travel data, personal contacts and employment details.

 

There is an undeniable need to balance privacy with the public interest, and the collection and processing of personal data can create discussions about the limitations imposed by data protection. The growing use of AI and big data to deal with the outbreak will require, at the same time, responsible and limited data collection and use during this public health crisis.

 

The Brazilian Data Protection Act (Law No. 13,709 / 18 or LGPD) will come into force on August 16, 2020. Nevertheless, the LGPD has been used as a basis for the protection of data subjects' rights by various protection agencies to the consumer (PROCONs, for example), the Public Ministry of the Federal District and Territories (through a Special Data Protection and Artificial Intelligence Unit) and by the courts of first instance in Brazil. Thus, companies and individuals who collect and process personal data (and sensitive personal data) must comply with the LGPD rules.

 

The Data Protection Law of Brazil has an important exception to its applicability whenever the data processing is carried out for exclusive public security purposes (to be regulated later). This exception could be used to prevent the applicability of LGPD during a public health crisis, for example, but measures have not yet been taken in this regard.

 

If we consider that the LGPD will be applicable to the processing of personal data, the Law allows data to be processed (without consent) for health protection, in procedures carried out by health professionals, health services or health authorities. The law also allows for the processing of data for the protection of the life of the data subject or third parties. These legal bases also apply to the processing of sensitive personal data.

 

It is important to note that the rights of data subjects and the LGPD principles must always be observed: data must be processed only for health-related purposes, when necessary, to achieve those objectives, for the benefit of natural persons and society as as a whole, with the State providing specific and adequate measures to protect the data. Thus, such processing should not result, for example, in data being processed for other purposes by third parties, even if by employers themselves or by insurance companies.

 

COVID-19 Resource Kit for companies dealing with the outbreak

Check all available content »

 

 

Link to article