On July 6, 2023, the Brazilian National Data Protection Authority (“ANPD” or “Brazilian DPA”) published a Preliminary Analysis regarding Bill No. 2,338/2023 (“Bill”), which seeks to regulate Artificial Intelligence (AI) systems in Brazil. The Bill, currently being processed by the Brazilian Federal Senate, was drafted with the support of a Commission of Jurists integrated by ANPD’s Director, Miriam Wimmer, and held multisectoral public hearings.
The Preliminary Analysis highlights that the regulatory policy outlined in the Bill – making the rights-based approach compatible with the risk-based approach – is similar to the direction adopted by the Brazilian General Data Protection Law (“LGPD”), pointing out the existence of three convergence fields between the two norms: (i) rights of the persons affected by an AI system and the rights of the data subjects; (ii) the link between high-risk AI systems and the processing of personal data; and (iii) governance mechanisms.
In the Preliminary Analysis, the ANPD states that, in addition to the aforementioned common points, there are tensions to be reconciled between the Bill and the LGPD to guarantee legal certainty in these fields with convergence.
Besides, the Brazilian DPA’s supports the deepening of the experimental regulatory environments, with the use of regulatory sandboxes, for Artificial Intelligence systems proposed in the Bill to foster responsible innovation in Brazil.
The Preliminary Analysis also defends the ANPD as a critical authority for Artificial Intelligence systems regulation in Brazil. This is because the possible creation of a new entity focused on this kind AI’s regulation or the attribution of competencies to another existing entity may generate regulatory fragmentation and competencies’ overlap with the Brazilian DPA, leading to legal uncertainty.
On the other hand, the centralization in the Brazilian DPA would reduce the compliance costs for economic agents and increase reliability in Artificial Intelligence systems’ use, especially considering that the ANPD has included in Phase 3 of its Regulatory Agenda for 2023-2024 the creation of guidelines on the use of AI on data processing, as we highlighted in this Newsletter.
Our team is at your disposal for further clarifications, as well as to provide assistance with the procedures for fulfilling LGPD and/or ANPD regulatory obligations.
Gustavo Flausino Coelho – gustavo@bastilhocoelho.com.br
Fernando Naegele – fernando@bastilhocoelho.com.br
Larissa Santos Bastos – larissa@bastilhocoelho.com.br