IX Conference on Civil Law and the impacts on Digital Law

The IX Conference on Civil Law took place in May 19 and 20, 2022, which also celebrated the 20^th anniversary of the Brazilian Civil Code (Law 10,406/2002) and the establishment of the Conference on Civil Law. The event is promoted by the Federal Justice Council (CJF), through the Judiciary Studies Center (CEJ), and was concluded with the approval of 49 statements.

This was the first Conference to include topics of Digital Law, all analyzed by the Commission of Digital Law and New Rights, leaded by Minister Ricardo Villas Bôas Cueva. The Commission affirmed the importance of the topic and approved 17 statements related to the Brazilian Data Protection Regulation (LGPD), digital heritage, transparency of proceedings and artificial intelligence (discussed by the Intellectual Property Commission).

Among the approved statements, we highlight the interest to direct the discussion regarding the processing of minor’s data (4 approved statements); inexistence of hierarchy among the legal bases determined in the LGPD; elaboration of the Data Protection Impact Assessment (DPIA); and the possibility of appointing more than one Data Protection Officer (DPO).

Such statements are essential to help private and public entities, as well as Courts and the Brazilian Data Protection Authority (ANPD) to issue consistent decisions, ensuring more legal certainty.

Find below the text of the Statements involving Digital Law, for ready reference:

• Statement ID 5172

The Law on Access to Public Information (LAI) and the Brazilian Data Protection Regulation (LGPD) establish compatible data management and protection systems. LGPD does not exclude publicity and access to information under the terms of the LAI, based on the legal bases of art. 7, II or III, and art. 11, II, a or b of the Brazilian Data Protection Regulation.

• Statement ID 5154

The Data Protection Impact Assessment (DPIA) should be understood as a measure of prevention and accountability for any data processing operation considered “high risk”, always taking as a parameter the risk to the rights of the data subjects.

• Statement ID 5148

The legitimate expectation of the data subject regarding the processing of his personal data is directly related to the principle of objective good faith and is one of the parameters of legality and lawfulness of the legitimate interest.

• Statement ID 5001

The Brazilian Data Protection Regulation does not exclude the possibility of the controller appointing a legal entity, an unincorporated entity, or more than one natural person to exercise the function of personal data controller.

• Statement ID 4997

The Brazilian Consumer Protection Code, as regulated by Law n. 8.078, of September 11, 1990, applies to the contractual relationships formed between the technology companies (involving transporation of passengers) and its users.

• Statement ID 4939

Personal identity also finds protection in the digital environment.

• Statement ID 4889

There is no hierarchy between the legal bases established in articles. 7 and 11 of LGPD.

• Statement ID 4809

For data processing carried out for the exclusive purposes listed in subsection III of Article 4 of LGPD (public security, national defense, state security and activities of investigation and prosecution of criminal offenses), the due process of law, the general principles of protection and the rights of the data subject provided for in the LGPD apply, without prejudice to the issue of specific future legislation.

• Statement ID 4806

The possibility of disclosing data and images of children and teenagers on the Internet should meet their best interests and respect their fundamental rights, considering the risks associated with overexposure.

• Statement ID 4796

Article 14 of LGPD does not exclude the application of other legal bases, if applicable, observing the best interests of the child.

• Statement ID 4716

The existence of documents containing sensitive personal data does not require the secrecy of the proceedings to be decreed. It is up to the judge, if he sees fit and depending on the data and how the document was produced, to declare the secrecy restricted to the specific document.

• Statement ID 4569

The legitimate interest of the third party, mentioned in item IX of Article 7 of LGPD, is not restricted to the individual or legal entity singularly identified, so its use is admitted in favor of groups or the community for processing activities that are of their interest.

• Statement ID 4334

The extended protection afforded by the LGPD to sensitive data should also apply to cases where there is sensitive processing of personal data, as noted in §1, art. 11 of the LGPD.

• Statement ID 4568

Digital assets can be part of the estate in the legitimate succession of the deceased owner and can also be disposed of in the form of a will or codicil.

• Statement ID 5016

The consent of the teenager for the processing of personal data, in accordance with art. 14 of the LGPD, does not remove the civil liability of parents or guardians for the acts performed by the teenager, including in the digital environment.

• Statement ID 5017

The concepts of child and adolescent, set forth in art. 14 of Brazilian General Data Protection Law, are applied to the contents of art. 2 of the Statute of the Child and Adolescent.

• Statement ID 5146

The protection afforded by the LGPD does not extend to legal entities, given its purpose of protecting the natural person.

Should you need more information about the LGPD or trends in the national and international scenarios, please do not hesitate to contact our Digital Law team at digital@kasznarleonardos.com.