Data Protection Authority releases study on data processing by research organizations

On May 3, 2022, the Brazilian Data Protection Authority (ANPD) released a technical study titled A LGPD e o tratamento de dados pessoais para fins acadêmicos e para a realização de estudos por órgão de pesquisa (The LGPD and personal data processing for academic purposes and studies by research organizations). The study evaluated a special framework within the Brazilian General Data Protection Law (LGPD) that applies to data processing exclusively for academic purposes, as well as certain aspects of data processing by research organizations. It focuses on the following points:

• The definition and scope of the concepts “data processing exclusively for academic purposes” (Article 4, II, “b”) and “research organization” (Article 5, XVIII) in the LGPD;
• Legal bases for authorizing personal data processing for research (particularly Article 7, IV and Article 11, II, “c” of the LGPD); and
• Researchers’ defined responsibilities and the appropriate method for proving their identity and relationship with research organizations, necessary for accessing and obtaining personal data for studies.

According to the ANPD, the study was developed to address questions that have been frequently raised by different actors, including the Judiciary, universities, research institutes and researchers.

As such, the study has established some important preliminary understandings to ensure that the LGPD’s provisions are properly observed, which are outlined below.

Partial derogation for academic research

The ANPD’s study has established that the LGPD (Article 4, II, b) provides for partial derogation when data processing is carried out exclusively for academic purposes. This article should be subject to restrictive interpretation, limited to situations where personal data processing is strictly linked to exercising academic freedom.

Yet even in this scenario, data processing must be supported by one of the legal bases provided for in the LGPD. Going beyond the LGPD’s text, the study clarifies that other provisions may also apply (such as Articles 6, 8, 10, 12 and 13). However, the study does not indicate all possible provisions that could apply to this situation.

Research organizations

In defining the concept of ‘research organization’, the ANPD’s study affirms that for-profit legal entities governed by private law are excluded from the list of processing agents the definition covers. Therefore, these entities are prohibited from using certain specific legal grounds to process data, as explained below.

Restrictions on legal bases for studies by research organizations

The LGPD’s Articles 7, IV, and 11, II, c permit data processing for “studies by research organizations, which must guarantee the anonymization of sensitive personal data whenever possible”. These databases cannot be used by for-profit legal entities and individuals acting on their own behalf or without any connection to a research organization.

However, the ANPD’s study recognizes that this does not mean such entities are prohibited from processing personal data for study and research purposes – rather, other legal bases should be evaluated in practice (e.g., legitimate interest and consent).

Responsibility for the data used in studies

The ANPD’s study highlights that it is important to correctly identify those authorized to access personal data and conduct studies on behalf of public bodies and entities legitimately recognized as research bodies. Thus, the ANPD recommends entities and bodies that provide access to personal data for studies and research verify the relationship between the researcher and the research body via a “term of awareness and responsibility”. This document should certify that the research organization is aware of the study and that it must comply with the LGPD.

Complying with other laws and regulations

Although entities may use one of the legal bases in Articles 7, IV, or 11, II, c to exempt themselves from obtaining consent from research participants, this does not remove the need to obtain consent when so required by other applicable legislation and ethical standards.

General requirements for conducting studies

Although Article 13 of the LGPD establishes specific requirements for public health studies, the ANPD’s study extends the application of this provision. It establishes that studies conducted in other academic fields should also observe the parameters of Article 13 as appropriate, in line with the specific characteristics of each case.

On the other hand, the study did not include an analysis or interpretation of specific criteria for providing access to or disclosing personal information under Brazil’s Access to Information Law (Law No. 12,527/2011). The study also lacks an analysis of standards and techniques used in anonymization and pseudonymization processes.

To assist it in creating new guidelines, the ANPD has released its findings to promote public debate and collect contributions from the public. The deadline for submitting comments and suggestions is June 3, 2022.

For further information on the subject, please contact Mattos Filho’s Data Protection & Cybersecurity practice.