When considering the application of the LGPD (Brazilian General Data Protection Law) in the context of advertising and marketing, there are many instances to be analyzed from different perspectives, all of which are relevant and can have significant impacts on both the data subject and the data controller.
A simple search for "types of marketing" revealed over 80 different types for various needs, segments, channels, niches, etc., such as: digital marketing (search engines, social media), offline marketing (magazines, newspapers, giveaways, telemarketing), content marketing (engagement in the buyer's journey), email marketing (content and offers via email), mobile marketing (considering mobile devices), SMS marketing (text messaging), geomarketing (user location), and so on… But what about privacy and the protection of personal data? How are these aligned with these typologies?
Advertising and marketing are directed at people; they are the ones who seek information, buy, decide, and form opinions about companies and products. And it is people's data that is used to communicate (such as images and voice), to segment a group by some criterion, to target through geolocation, to guide strategy based on online behavior, to create entertainment at a show or a sense of belonging at a religious event, among other possibilities. This means that privacy and the protection of personal data are inherent in the entire communication process and, therefore, the LGPD (Brazilian General Data Protection Law) is intimately related.
Initially, data controllers, that is, agents responsible for processing personal data, must register such activities, determine the purpose, submit the activity to analysis considering the principles of the Law, identify the risks to data subjects and the organization, and indicate respective mitigation actions. Following this, they must assign the appropriate legal basis (between consent, the execution of a contract, and the legitimate interest of the controller), considering cases of application of image rights, and finally, provide a service channel for data subjects.
Regulatory documentsData protection policies or notices, such as Privacy and Data Protection Policies, demonstrate the controller's transparency and good faith in the processing of personal data, inform about possible data sharing, and should mention the use of best practices and technical and administrative information security measures applied. It is worth emphasizing (so as not to say I haven't mentioned any positive aspects) that this entire institutional regulatory framework is only valid when it aligns with the controller's reality.
However, even with the data controller acting in accordance with the LGPD (Brazilian General Data Protection Law), questions remain, mainly regarding practical application: how to reconcile the use of images with individuals in public in contextual photos in a commercial advertisement? How to identify in a crowd who has not consented to the capture and publication of images for a specific purpose, such as in a street race? Is there any risk in separating the data subjects who do not consent to the capture of their image, such as in a religious temple? A sound alert or a checkbox that warns about kisscam Does this exempt the controller from liability for a privacy violation? Does the image usage agreement cover the institutional publication of students' images on social media during educational activities?
We have been making steady progress towards defining and maturing the topic with the National Data Protection Authority. The regulatory and normative inputs we have allow us to carry out our activities in a supported manner. As data controllers, we must understand our duties considering both the LGPD (Brazilian General Data Protection Law) and other related regulations. As data subjects, we must learn about our rights, our limits, and the consequences of our choices. The LGPD brings new perspectives to marketing, both offline and digital, and this is an opportunity to... adequacy Transparency, good reputation, and respect for privacy are born from legislation. A win for everyone!
Want to know about regulatory documents? Learn the truth about them. here.
