Diagnostic of Data Processing by Brazilian Organizations—A Low Compliance Issue

Abstract

In order to guarantee the privacy of users’ data, the Brazilian government created the Brazilian General Data Protection Law (LGPD). This article made a diagnostic of Brazilian organizations in relation to their suitability for LGPD, based on the perception of Information Technology (IT) practitioners who work in these organizations. We used a survey with 41 questions to diagnose different Brazilian organizations, both public and private. The diagnostic questionnaire was answered by 105 IT practitioners. The results show that 27% of organizations process personal data of public access based on good faith and LGPD principles. In addition, our findings also revealed that 16.3% of organizations have not established a procedure or methodology to verify that the LGPD principles are being respected during the development of services that will handle personal data from the product or service design phase to its execution and 20% of the organizations did not establish a communication process to the personal data holders, regarding the possible data breaches. The result of the diagnostic allows organizations and data users to have an overview of how the treatment of personal data of their customers is being treated and which points of attention are in relation to the principles of LGPD.

Framework Conceitual Utilizando BPM para Identificação e Tratamento de Dados Pessoais e Sensíveis de Doadores de um Serviço de Hemoterapia

“…Desta forma, com esse alcance mundial da GDPR, o Brasil sancionou, em 14 de agosto de 2018, a Lei Geral de Proteção de Dados (LGPD), Lei nº 13.709 (BRASIL, 2018), que entrou em vigor em 18 de setembro de 2020, e tem, como base na GDPR, a finalidade de estabelecer as diretrizes para a coleta, o processamento, o armazenamento e o tratamento de dados pessoais no Brasil (BRASIL, 2018;FERRÃO et al, 2021;PELLOSO PIURCOSKY et al, 2019;SILVA;CALEGARI;GOMES, 2019).…”

“…Assim, o tratamento desses dados sensíveis está na Seção II -Do tratamento de dados Pessoais Sensíveis, arts. 11, 12 e 13 (BRASIL, 2018) e é considerado o principal objetivo da aplicabilidade da LGPD (FERRÃO et al, 2021).…”

“…Além disso, caberá a esses responsáveis e suas organizações a formulação de PCA que se adeque a LGPD, buscando a implementação de normas de privacidade e segurança, padrões técnicos, obrigações para aqueles que tratam os dados, ações educativas para empregados/servidores e, por fim, supervisão de riscos envolvendo o tratamento de dados pessoais, o que trará mais transparência para as organizações brasileiras e o comprometimento com seus usuários (BRASIL, 2018;FERRÃO et al, 2021).…”

A Framework for Privacy and Security Requirements Analysis and Conflict Resolution for Supporting GDPR Compliance Through Privacy-by-Design

“…As we find out that there are more that regulation and laws concern privacy disclosure. For instance, Brazilian citizens' complaints regarding data privacy are rising by the day, particularly with the access into force of the General Data Protection Law (LGPD) [34]. The purpose of the Act is to regulate the handling of personal data.…”

Guidelines adopted by agile teams in privacy requirements elicitation after the Brazilian general data protection law (LGPD) implementation

“…This Law applies to organizations in Brazil and organizations that are not physically located in Brazil but offer goods and services or process personal data in Brazil, and its primary purpose is the processing of individuals’ personal data, i.e., information related to an identified natural person, such as name, age, marital status, and documents, performed by controllers and processors [ 2 ]. Regarding data privacy, several models were proposed with principles similar to LGPD [ 21 , 22 ], among them ISO/IEC 29100 – Information technology — Security techniques — Privacy framework [ 23 ] and the General Data Protection Regulation – GDPR [ 1 , 24 ]. GDPR started effect in the European Union (EU) on May 25, 2018, through the Regulation EU 2016/679 [ 1 ].…”