16 Sep Process bill intend to amend LGPD and the Law of Guidelines and Baseline for Education is in process
By Fabio Vieira and Gabriela Tchalian
On March 8, 2022, Deputies Thiago Mitraud and Adriana Ventura, both from the New Party, presented in the House of Representatives Bill No. 454/2022 (“PL No. 454/2022”), which now awaits consideration by the Federal Senate.
PL No. 454/2022 intends to amend Law No. 9,394/1996 (“Law of Guidelines and Baseline for Education”) and Law No. 13,709/2018 (“General Data Protection Law – LGPD”).
Regarding Law of Guidelines and Baselines for Education, PL No. 454/2022 intended to amend article 5th, which establishes compulsory basic education as a subjective demandable public right, in order to include paragraphs 6th and 7th, with the following text:
‘§6th The Public Power is authorized to share and publish raw data and microdata collected in the school census over which inc. I of §1st of this device deals, provided they are anonymized or pseudonymized.
§7th – The Public Power is authorized to share and publish raw data and microdata collected through the National High School Exam, including segmented by educational institution, provided they are anonymized or pseudonymized.”
For the LGPD, PL No. 454/2022 intends to amend article 14, which provides for the processing of personal data of children and adolescents, for inclusion of paragraphs 7th and 8th.
This amendments states that the rules for the processing of personal data of children and adolescents would not apply to cases of sharing of personal data collected in the school census and by the National High School Exam (“Enem”), as follows:
‘§7th The sharing of personal data collected in the school census, which §3rd of art. 208 of the Federal Constitution and inc. I of §1st of art. 5 of Law No. 9,394, of December 20, 1996, provide for, even if from children and adolescents, is independent of compliance with the requirements of §§1st to 6th.
§8th – The sharing of personal data collected through the National High School Exam, even if from children and adolescents, is independent of compliance with the requirements of §§1st to 6th.’
It also aims to amend article 26 of the LGPD, which deals with shared use of personal data by the Public Power, to allow for sharing and publicization of raw data and microdata collected in the school census and Enem if anonymized or pseudonymized by the inclusion of paragraphs 3rd and 4th.
‘§3rd The Public Power is authorized to share and publish raw data and microdata collected in the school census that §3rd of art. 208 of the Federal Constitution and the inc. I of §1st of article 5 of Law No. 9,394 of December 20, 1996, provide for, as long as they are anonymized or pseudonymized.
§4th – The Public Power is authorized to share and publish raw data and microdata collected through the National High School Exam, including segmented by educational institution, as long as they are anonymized or pseudonymized.’
It is worth remembering, however, that LGPD expressly excluded anonymized data from its scope. Thus, even if PL No. 454/2022 was to be fully rejected, usage of anonymized data by the government was already possible. On the other hand, adding the possibility of disclosing pseudonymized data and microdata from children and teenagers, depending on the context, might create a privacy risk for such subjects.
In the Justification of PL No. 454/2022, the deputies narrated the episode in which National Institute of Educational Studies and Research Anísio Teixeira (“Inep”) published the data and microdata of the School Census of Basic Education and Enem with delay, reduced and making the historical series unavailable claiming adaptation to the LGPD.
It was argued that Inep’s conduct prevented understanding of the national education scenario, the evolution of learning and the conditions of education in Brazil. This is because the data provided did not allow segmentation by school, that is, the identification of the individual performance of students by educational institution.
Parliamentarians also stressed that Inep had had 2 (two) years to adapt to LGPD, so that compliance with the standard could not be used as an excuse for the delay and lack of transparency of public information.
Finally, they emphasized the importance of data for government policies supported by the Federal Constitution, one of the legal grounds for the processing of personal data provided for in article 7, III, LGPD.
On March 16, 2022, the authors of PL No. 454/2022 submitted an application for urgent consideration, taking the project to the Committees of Science and Technology, Communication and Informatics, Education and Constitution and Justice and Citizenship for conclusive consideration. The application for urgency, however, was only approved on March 31, 2022.
On April 5, 2022, Deputy Mr. Felipe Rigoni was appointed as rapporteur of PL No. 454/2022. The rapporteur delivered an opinion for the approval of PL No. 454/2022 in the form of its replacement.
PL No. 454/2022’s replacement excluded its amends to LGPD (which seems to be the right choice for us and in accordance with other data protection laws, as in Europe and Canada), but expanded the list of amends to the Law of Guidelines and Baselines for Education for greater specification of the data involved and conditions to be observed.
Three (3) amendments to the replacement were submitted, and only those of number 2 and 3 were approved.
On April 20, 2022, PL No. 454/2022 was submitted to the Federal Senate. Click here to access the replacement submitted text.
PL No. 454/2022 was not the only consequence of Inep’s conduct. On May 17, 2022, National Data Protection Authority (“ANPD”) issued Technical Note No. 46/2022/CGF/ANPD (“Technical Note”) to assess the adequacy of microdata made available by Inep considering LGPD compliance.
According to ANPD, the Technical Note was prepared due to the suspension of the disclosure of microdata by Inep and a clarification note issued by the entity, in which it claimed that:
(i) the disclosure of microdata on the portal would be carried out according to LGPD;
(ii) disclosure would be appropriate to objective criteria that would reduce the risks of identifying data subjects;
(iii) its conduct was based on a study made together with Federal University of Minas Gerais, which found risks to privacy, including reidentification and inference of sensitive attributes, in the techniques of dissemination of microdata so far used;
(iv) there would be no restriction for educational research and studies, since other means of access to information not disclosed by Inep would continue to exist; and
(v) Inep intended to establish partnerships with federal institutions of higher education to expand its capacity to adequately make data available.
ANPD chose to split its analysis into three (3) main topics.
First, it deliberated on his own competence to participate in the discussion. In this section, ANPD concluded that it had jurisdiction to decide upon doubts about data protection and interpretation of the LGPD, according to article 55-J, I, IV, VI, XIV and XX, LGPD.
The next section focused on the possibility of Inep disclosing microdata from educational censuses. Here, it was considered to be a debate on the right to privacy and data protection as opposed to the right to information regarding the activities of the Public Power.
Recalling that, for the Public Administration, the general rule established in Law on Access to Information is the publicity of the acts.
ANPD understood that, despite the duty of publicity, Inep could not do without complying with LGPD, and should assess the risks and impacts, as well as possible measures to mitigate them. Also, as a body of the Public Power, it should observe the Orientation on the Processing of Data by the Public Sector Guideline.
As for the legal basis for data processing applicable to the disclosure of microdata, ANPD explained that the correct framework would be the hypothesis of conducting studies by research bodies, provided for in article 7, IV, LGPD, not consent.
Finally, ANPD deliberated on anonymization, disclosure of personal data and impact report.
It was clarified that, under LGPD, anonymized data are not personal data. However, it is accepted that there may be a risk of reidentification. For the Public Power, there is an acceptable limit of risk of reidentification, provided that the processing of anonymized data is relevant to the public interest.
In this sense, Inep could avail itself of other information security and data protection measures, both of technical and administrative nature.
The importance of broadly assessing the risks and appropriate security measures to mitigate them has been taken up here. However, ANPD took this section one step further: it required the preparation of a Data Protection Impact Report (“RIPD”), regulated on articles 4th, §3; 5th, XVII; 32; and 38, LGPD.
In short, ANPD’s Technical Note concluded that (i) processing of microdata by Inep is legitimate, (ii) LGPD principles should be observed, (iii) measures other than anonymization could and should be adopted, (iv) Inep should draw up the RIPD.
It is worth mentioning that neither the ANPD’s Technical Note nor PL No. 454/2022 dealt with the definition of the term ‘microdata’.
It seems to us that both Inep and PL No. 454/2022 drafters have shallow knowledge – not to say they do not possess any knowledge – on LGPD’s content and, instead of stimulating a better evaluation over microdata (or personal data) disclosure and which measures should be adopted on fundamental rights protection, notably for children and teenagers, they chose an attempt to create another legislative aberration.
Click here to access the Technical Note.
This article is intended exclusively to provide information and does not contain any opinion, recommendation or legal advice from KV Advogados in relation to the matters herein addressed. Copyrights are reserved to Kestener & Vieira Advogados.
No Comments