Continuing our series of interviews with leading figures in the privacy market, we invited Ana Paula Canto de Lima.
Ana Paula is a lawyer, founder of Canto de Lima Advocacia, and co-founder of the "LGPD Learning Edutech Co." course on the "Cadê meu dados?" platform.
With expertise in Digital Law and data protection, Ana Paula holds a master's degree from UFRPE and an LLM with dual certification: LGPD and GDPR – Brazil/Portugal from the Faculty of Law of the University of Lisbon and FMP Escola Superior Ministério Público.
Furthermore, she is a Professor of courses and postgraduate programs in Digital Law and Personal Data Protection.
Below is an interview with Ana Paula Canto de Lima.
How would you rate the progress made in privacy and data protection over the past five years?
Five years after the enactment of the LGPD (Brazilian General Data Protection Law), I see great progress. We are beginning to talk about this topic; it's not yet something as commonplace or widely known in society as we would like, but little by little we are building this path, and we are doing well. Currently, there is already a greater interest in the subject; we already have access to news bringing information about privacy and data protection, showing flaws, leaks, data exposure, and even court decisions imposing heavy compensation in other countries that have a greater maturity than ours. It's not happening as quickly as we would like; after all, privacy and data protection is about cultural change, and all cultural change is slow and demands a series of efforts. I've always had the impression (and it's not just mine) that, in Brazil, things only work when they "hit the wallet," and with the LGPD it would be no different. Initially, there was anticipation about when the ANPD (National Data Protection Authority) would start acting, then the expectation was about how the ANPD would act? How would it interpret and handle the demands brought by the legislation? How would it interpret the points that need guidance? How would the sanctions brought about by the law be implemented? And from my perspective, the expectation was not only from professionals, but also from the individuals involved in the law, especially the data controllers. The wait for the Authority's action may have led to questions about the law's effectiveness, causing some companies to delay taking the first steps, raising the recurring question: "Will the LGPD (Brazilian General Data Protection Law) really take hold?". After 5 years and with the first sanction applied, considering all the activities of the ANPD (National Data Protection Authority), it became clear that there is no going back; data protection is a reality in Brazil and there is no way to avoid it.
What have been the main impacts of the LGPD (Brazilian General Data Protection Law) over the last five years since its implementation?
I believe the main impact concerns how citizens are beginning to protect their data. I've noticed that many people have started questioning, "Why does this company want to collect my data?" "For how long?" etc. It's also noticeable that there has been a considerable increase in complaints and reports on platforms like "Reclame Aqui" and "Cadê meu dados?". It's also important to highlight the growing number of lawsuits related to the LGPD (Brazilian General Data Protection Law). Data subjects have also started using administrative means, filing complaints and requests with the ANPD (National Data Protection Authority) and Procon (Consumer Protection Agency). However, because it's a new law full of nuances, it's essential that judges stay updated; simply reading the law isn't enough. Merely reading the law misses relevant points that require more careful consideration and deeper analysis; failing to do so can lead to misinterpretations in some decisions. On the other hand, lawyers need a better understanding of the LGPD to avoid filing lawsuits with nonsensical requests that will be unsuccessful, weakening the legislation with unfavorable decisions due to a lack of comprehension. But this is also not uncommon, considering that it is new legislation.
What technological advancements or emerging trends do you believe could significantly influence the implementation and ongoing compliance with the LGPD (Brazilian General Data Protection Law) in the coming years?
The more technology advances, the more necessary it is to consider issues such as privacy and data protection; it is no longer possible to think about any project, system, program, or prototype without considering these issues. Artificial intelligence will undoubtedly demand special attention from professionals; in addition to the regulation that needs to advance, there must be progress regarding biases and standards, and regarding security in the use of personal data. A balance between the interests of developers and the interests of data subjects is essential, as is robust protection. Applications and systems that use artificial intelligence urgently need to consider the privacy and security of the data subject as an indispensable part of the project. It should be essential to consider privacy by design for projects and tools that work with personal data. On the other hand, the data subject/consumer needs to be increasingly informed and aware of the importance of their data, to the point of choosing companies, products, and services based on this premise. And this will happen through awareness and guidance. Companies that have adapted to the LGPD (Brazilian General Data Protection Law) must continue with the project; adaptation is cyclical, with new projects, new products, new data, and new clients constantly emerging. Therefore, if those who invested in adaptation do not continue, if they do not understand that data protection has become part of the company, they will soon no longer be compliant.
From your perspective, what are the future expectations for the LGPD (Brazilian General Data Protection Law), considering possible changes, regulatory improvements, and developments in the field of digital privacy?
There is still much to improve; many issues still require interpretation and guidance from the ANPD (National Data Protection Authority). The Authority has done a good job despite the challenges, such as budget constraints, a small staff, and a Council that has barely been able to contribute (not for lack of interest). Civil society has also been helpful, as have professionals who promote the topic in various ways, whether through events, live streams, publications, books, etc. Naturally, over time the judiciary will settle the issue, and this will contribute to legal certainty. Soon, citizens/data subjects will also have greater maturity and will begin to be more selective, and being compliant will finally become a clear competitive advantage. At that point, not giving importance to data protection could be fatal for a company.
Keep following our blog and stay up-to-date on the world of privacy and data protection.
