The Brazilian National Data Protection Authority (“ANPD” or “Brazilian DPA”) issued on May 24, 2023, its first Statement (Statement CD/ANPD n. 1), which consolidates the interpretation regarding the legal grounds that authorize the underages’ personal data processing, according to the Brazilian General Data Protection Law (“LGPD”).
The interpretative consolidation on the subject is part of the ANPD’s institutional competence, according to LGPD’s Article 55-J, item XX, and it was prompted by controversy among academics, professionals in the field and civil society representatives, who pointed to legal uncertainty as to which legal grounds would authorize the minors’ personal data processing by the controller.
There possible interpretations by the ANPD would be: (i) only those in LGPD’s Article 7, which provides for the need for consent and other general personal data processing hypotheses; (ii) only those indicated in Article 11, based on an interpretation that minors’ personal information is equivalent to sensitive data; or (iii) both the legal grounds indicated in LGPD’s Articles 7 and 11 could be used.
The Brazilian DPA’s choice was the third interpretation, considering the provisions on both LGPD’s Articles 7 and 11 as valid legal bases for minors’ personal data processing. The ANPD also emphasized that any treatment in this regard must take into account the minors’ best interest principle – embodied in LGPD’s Article 14.
It is worth mentioning that this conclusion had already been indicated to be the chosen one since 2022, when the ANPD released a Preliminary Study on the subject.
The Statement release represents, therefore, the ANPD’s consolidation on the discussion and solidifies the minors’ best interest principle as an important aspect to be considered in these data subjects’ personal data processing in Brazil – a theme that will also be further addressed in a future specific Orientation Guide, as reported by the Authority.
Our team is at your disposal for further clarifications, as well as to assist you with questions related to data protection.
Gustavo Flausino Coelho – gustavo@bastilhocoelho.com.br
Fernando Naegele – fernando@bastilhocoelho.com.br
Larissa Santos Bastos – larissa@bastilhocoelho.com.br