Processing of children’s and adolescents’ data set to be regulated in Brazil

On September 8, 2022, the Brazilian National Data Protection Authority (ANPD) opened a public consultation to regulate the processing of children’s and adolescents’ personal data. Interested parties may submit suggestions via the Participa + Brasil platform by October 7, 2022. The ANPD has also published a preliminary analysis of how children and adolescents’ data is processed, highlighting the hypotheses established in Articles 7 and 11 of Law No. 13,709 (Brazilian General Data Protection Law – LGPD). In practical terms, the ANPD’s proposal should guarantee data processing entities more flexibility in dealing with a wide range of real-world situations, as it provides for a more extensive legal hypothesis for processing children’s and adolescents’ data.

The LGPD applies a special framework to processing children’s and adolescents’ personal data. Aligned with local and international legal frameworks, Article 14 of the LGPD determines that such data must be processed in the best interests of the data subjects.

According to the ANPD, the LGPD’s provisions are unclear on how and when to process children’s and adolescents’ data, leading to legal uncertainty for data processing agents. For this reason, the ANPD is now holding a public consultation to consider the public’s opinion on the matter and potentially improve its proposal.

Main conclusions from the preliminary analysis

The preliminary analysis considered the processing of children’s and adolescents’ data under the LGPD’s provisions, seeking to promote public discussion on the matter and facilitating the ANPD’s ability to set more precise guidelines.

The ANPD has stated that the preliminary analysis did not consider the relationship between the LGPD and the framework for individual civil capacity provided for in the Brazilian Civil Code, nor how to verify users’ age online and whether they have given consent for their data to be processed.

The analysis considered three interpretive hypotheses of Article 14 of the LGPD for justifying the processing of children’s and adolescents’ data, considering the legal bases provided for in the LGPD. Under these hypotheses, data processing agents would need to rely on:

• The consent of children’s and adolescents’ legal guardians under the terms of Article 14, paragraph 1 of the LGPD; or

• One of the legal bases provided for in Article 11 of the LGPD, which applies to the processing of sensitive personal data and imposes stricter processing requirements; or
• One of the legal bases provided for in Articles 7 (non-sensitive data) and 11 (sensitive data) of the LGPD, as the case may be, while observing the best interests of children and adolescents.

At this stage, the ANPD has decided to apply the latter option (which recognizes the possibility of applying the legal hypotheses outlined in Articles 7 and 11, provided that the best interests of children and adolescents are observed) to provide greater protection to children and adolescents. Certain arguments that favor this interpretation are outlined below:

• It provides more flexibility in regard to a wide variety of real-world situations;
• It avoids establishing abstract prohibitions on the use of certain legal hypotheses without considering the limitations and practical consequences of prohibiting them;
• It does not prevent the ANPD from setting restrictions on processing the personal data of children and adolescents in specific situations; and
• As recommended by the LGPD, it does not establish a hierarchy between the different legal hypotheses.

In analyzing the advantages and disadvantages of each of these hypotheses, the ANPD’s proposal states the following: “Children’s and adolescents’ personal data may be processed according to the provisions of Article 7, or in the case of sensitive data, Article 11 of the LGPD, given that the data subjects’ best interests are observed, as per the terms of Article 14.”

Furthermore, the ANPD has provided a more comprehensive definition of children and adolescents’ data. Not only does the definition include information children and adolescents consciously share online, but it also covers information obtained from their activities in the digital environment and information revealed by their parents and friends.

Public consultation

Once it has finished considering the public’s suggestions, the ANPD will ultimately determine how children’s and adolescents’ personal data should be processed according to the LGPD. The ANPD’s complete preliminary analysis can be read here (in Portuguese).

For more information on the ANPD’s activities, please contact Mattos Filho’s Data Protection & Cybersecurity practice area.