Brazilian Data Protection Authority opens public consultation on data protection and AI

On November 6, 2024, the Brazilian Data Protection Authority (ANPD) published a Public Consultation related to proposed regulations on Artificial Intelligence (AI) and Data Protection. The Public Consultation includes 15 questions organized into four blocks: Brazilian Data Protection Law (LGPD) principles, legal bases, data subjects’ rights, and best practices and governance.

In order to balance free enterprise and technological development with the protection of data subjects’ rights, this initiative aims to gather contributions on AI-related practices and potential associated risks, including issues related to algorithmic bias.

Questions

An overview of the 15 questions included in the Public Consultation (divided into four blocks) is provided below:

• LGPD principles: according to the ANPD, AI system development and use should be guided by the principles that direct personal data processing activities. In this regard, the authority has included questions on how to align principles with the use and training of AI (for example, the principle of necessity) and applicable best practices and safeguards;
• Legal bases: various legal bases can, in different contexts, support personal data processing throughout the AI system’s lifecycle. However, according to the ANPD, the legal bases that require the most discussion are those concerning consent and legitimate interest. In this context, the questions revolve around how both legal bases are applied and the challenges related to them;
• Data subjects’ rights: the ANPD has stated that one of the most critical aspects regarding AI impacts concerns decision-making based solely on automated personal data processing, which can produce legal effects or significantly impact individuals’ interests. In this regard, the questions in this block seek to define the scope and extent of the right to review automated decisions, the appropriate level of transparency, and the need for human review. As for the other rights established by the LGPD, the ANPD is seeking contributions on how they should be applied, best practices, and safeguards;
• Best practices and governance: the ANPD has highlighted that governance and adopting best practices for using personal data in AI systems can be an effective strategy for data processing agents to ensure data subjects’ rights are protected, and the LGPD is complied with. Therefore, the authority is questioning how governance programs could be used in this context. Additionally, questions about what information should be documented during the lifecycle of an AI system and anonymization have also been included.

Those interested in contributing to the Public Consultation can submit their considerations through the Plataforma+Brasil by December 5, 2024.

For more information on the topic, please contact Mattos Filho’s Technology practice area.