2.2.2 Anonymised Data
The Brazilian Personal Data Protection Law also provides another category of data
called anonymised data, defined by law as “data related to an unidentified person,
considering the use of reasonable available technical means at the time of its
process” (Article 5, item III). Personal data can become anonymised through data
anonymisation, which is described by legislation as “the use of reasonable available
technical means at the time of the processing by which data can no longer be directly
or indirectly associated to an individual” (Article 5, item XI). The Law does not
consider anonymised data as personal data, unless it is possible to reverse the data
anonymisation (Article 12).
The legislation guarantees the anonymisation of any excessive, unnecessary or
inappropriately treated personal data if requested by the holder at any time (Article
18, item IV). Moreover, the Law assures the right to anonymisation on some specific
processing, such as studies conducted by research institutes (Article 7, item IV).
Anonymisation is also a requirement in case the controller decides to keep personal
data after the end of the processing operation (Article 16, item IV).
2.3 Principles of Data Protection
The Brazilian Personal Data Protection Law establishes the following principles on
the subject: principles of purpose, adequacy, necessity, free access, data quality,
transparency, security, prevention, non-discrimination and accountability (Article
6). In summary, it is required that: (a) data processing always be performed for
purposes in accordance with the legal system, (b) that the use of the required data be
limited to those purposes, and (c) that the processing is safe and transparent.
2.4 Scope of Protection
The protection of personal data has its scope defined in Article 3 of the Brazilian
Personal Data Protection Law, which ensures protection against “any processing
operation carried out by an individual or legal entity of public or private law,
independently of the means, the country of its headquarters or the country where the
data is located”. It is established that protection against processing of personal data
is granted, provided that: (1) processing operations are performed in national
territory; (2) treatment activities have the purpose of offering or providing goods
or services, or data treatment of individuals located in national territory; (3) the
personal data subjected to treatment has been collected in national territory.
Public entities also have a specific applicable law regarding public access to
information (Federal Law n
12.527/2011), which provides guidelines for data
Right to Privacy and Personal Data Protection in Brazilian Law
47
The Brazilian Personal Data Protection Law also provides another category of data
called anonymised data, defined by law as “data related to an unidentified person,
considering the use of reasonable available technical means at the time of its
process” (Article 5, item III). Personal data can become anonymised through data
anonymisation, which is described by legislation as “the use of reasonable available
technical means at the time of the processing by which data can no longer be directly
or indirectly associated to an individual” (Article 5, item XI). The Law does not
consider anonymised data as personal data, unless it is possible to reverse the data
anonymisation (Article 12).
The legislation guarantees the anonymisation of any excessive, unnecessary or
inappropriately treated personal data if requested by the holder at any time (Article
18, item IV). Moreover, the Law assures the right to anonymisation on some specific
processing, such as studies conducted by research institutes (Article 7, item IV).
Anonymisation is also a requirement in case the controller decides to keep personal
data after the end of the processing operation (Article 16, item IV).
2.3 Principles of Data Protection
The Brazilian Personal Data Protection Law establishes the following principles on
the subject: principles of purpose, adequacy, necessity, free access, data quality,
transparency, security, prevention, non-discrimination and accountability (Article
6). In summary, it is required that: (a) data processing always be performed for
purposes in accordance with the legal system, (b) that the use of the required data be
limited to those purposes, and (c) that the processing is safe and transparent.
2.4 Scope of Protection
The protection of personal data has its scope defined in Article 3 of the Brazilian
Personal Data Protection Law, which ensures protection against “any processing
operation carried out by an individual or legal entity of public or private law,
independently of the means, the country of its headquarters or the country where the
data is located”. It is established that protection against processing of personal data
is granted, provided that: (1) processing operations are performed in national
territory; (2) treatment activities have the purpose of offering or providing goods
or services, or data treatment of individuals located in national territory; (3) the
personal data subjected to treatment has been collected in national territory.
Public entities also have a specific applicable law regarding public access to
information (Federal Law n
12.527/2011), which provides guidelines for data
Right to Privacy and Personal Data Protection in Brazilian Law
47