The National Data Protection Authority (“ANPD”) has initiated a public consultation to gather inputs from society regarding its regulatory project on Artificial Intelligence (“AI”) and data protection, considering the provisions of the Brazilian General Data Protection Law (“LGPD”).
The purpose of this initiative is to collect contributions from different sectors regarding the use of personal data in AI systems, including automated decisions based on personal data and the right of review guaranteed by the LGPD, in order to support future ANPD regulation on the subject.
The public consultation is structured into 15 questions, divided into 4 thematic blocks:
1) LGPD Principles: This block highlights that the principles of the LGPD are applicable to the development and use of AI systems. The ANPD explores ways to harmonize these principles with the training and operation of AI systems, emphasizing best practices and safeguards to prevent excessive or inappropriate use of personal data and ensure transparency.
2) Legal Hypotheses: The possible legal bases for data processing throughout the AI lifecycle are discussed, with emphasis on the hypotheses of consent and legitimate interest. Considering the limitations and challenges in their application, particularly in the context of sensitive data (e.g., personal data on racial or ethnic origin, religious beliefs, political opinions, health or sexual life data) and AI system training, the possibilities and safeguards of each option are questioned.
3) Data Subject Rights: The ANPD examines the impact of automated decisions with legal or relevant effects on individuals’ lives, questioning the scope of the right to review these decisions, the appropriate level of transparency, and the need for human intervention. Furthermore, other data subjects’ rights provided in the LGPD are considered, seeking contributions for their practical application and identification of best practices.
4) Best Practices and Governance: The last block focuses on strategies to promote responsible governance in the use of AI with personal data. The ANPD investigates how to implement privacy governance programs as a mechanism to promote compliance with the LGPD in the development and use of AI systems. For this purpose, it questions which information should be recorded throughout the lifecycle of an AI system and how anonymization can contribute to the data protection.
The questions that are part of the consultation have a technical and organizational nature, aiming to map current practices and their alignment with the LGPD guidelines and ANPD regulations. The General Coordination of Standardization ("CGN"), responsible for the initiative, clarifies that these contributions aim to reconcile technological innovation and free enterprise with the safeguarding data subjects’ rights in guiding future regulation.
The term was recently extended by ANPD. Contributions can be submitted until January 24, 2024, through the Participa+Brasil platform.
The Technology and Data Protection team at Cescon Barrieu remains available to assist you with topics related to AI and personal data protection.
