*This is an AI-powered machine translation of the original text in Portuguese

The General Data Protection Law (Lei Geral de Proteção de Dados – LGPD), Law No. 13,709/18, was the first national instrument created exclusively for the treatment of personal data. With this law, we moved away from the previous legal landscape, where the use of personal information by third parties was regulated only by scattered legal provisions, and entered a new international level, having regulations on data protection and privacy.

LGPD regulates the use of personal data in both physical and digital environments, ensuring a range of new rights for data subjects, similar to what the General Data Protection Regulation (GDPR) did in Europe. For example, individuals now have the right to consent to and withdraw consent for the collection and processing of data, the right of access, the right to rectify and review decisions made by automated means, among others. The law also introduces concepts such as controller, processor, and data protection officer, establishing obligations for each of these entities.

It is undeniable that this law raises the national standard regarding data protection. However, when the LGPD was sanctioned, then-President Michel Temer vetoed the articles related to the creation of the data protection oversight authority – the National Data Protection Authority (Autoridade Nacional de Proteção de Dados or ANPD) – citing a formal legislative process flaw, as the creation of the ANPD was within the Executive's competence. This veto created a gap in the law, which conditions the effectiveness of some articles on an authority that ceased to exist. To address this gap, Provisional Measure No. 869 was issued at the end of last year, reestablishing the ANPD and the National Council for Personal Data Protection and Privacy. In the six days following its issuance, 176 amendments were proposed to the MP. In total, 44 deputies and senators from 17 parties submitted proposals.

Due to the slow progress in the examination of the MP and its amendments, the vote on the texts entered into an urgent regime, and it was only on March 27, 2019, that the mixed committee to evaluate the proposals was constituted. On March 28, the validity of the MP was extended, and it must be voted on by the end of May, under penalty of losing its effectiveness.

Regarding the amendments presented to the MP's text, it is noted that the articles related to the ANPD were the ones that attracted the most interest from lawmakers (with 48 amendments proposed solely to amend Article 55), as shown in the graph below. It is noteworthy that issues such as the scope of the law's application (Article 4), legal definitions (Article 5), processing scenarios (Article 7), processing of sensitive data (Article 11), rights of data subjects (Articles 18 and 20), data sharing (Article 26), duties of the data processing officer (Article 41), among others, drew the attention of lawmakers.

Chart Showing the Number of Proposed Amendments per Article of the LGPD

Article 20 guarantees individuals the right to request a review of "decisions made solely based on automated processing of personal data." Lawmakers proposed 13 amendments to its text, which was modified by the MP. The main change relates to who should conduct the review of an automated decision when requested. Eleven lawmakers proposed that the article return to its original wording, reintroducing the qualifier "by a natural person" to the revisions provided.

Amendment Proposal No. 17 explains in its rationale that "Provisional Measure No. 869/2018 created a rather concerning possibility: that the right to review automated data processing could be exercised, in practice, by the same automated mechanisms that generated the error in the first place." The same rationale is echoed in Amendment Proposals No. 43, 50, 70, 83, 103, 130, 142, 151, and 158. Amendment Proposal No. 165 further points out that reevaluating such automated decisions through automated processes hinders effective reassessment, which would violate the very purpose of the article.

Amendment Proposals No. 5 and 111, on the other hand, seek to remove the auditing power of the ANPD to verify if a data controller has acted discriminatorily. This prerogative of the National Authority exists for cases where the controller refuses to provide clear information about the criteria and procedures of their automated decision-making system. In their justifications, both proposals raise concerns about industrial secrets and the protection of data of the audited companies.

The central theme of all the amendments revolves around the concept of algorithmic discrimination. Simplistically, algorithmic discrimination occurs when socially pre-established concepts are intentionally or unintentionally transferred into the lines of code that govern automated decision-making. In cases where this transfer occurs, the algorithm begins to reproduce a flawed decision-making logic on a large scale. However, algorithms are incapable of questioning their results and recognizing errors in their decisions. Therefore, ensuring that the review of automated decisions is conducted by natural persons is crucial for the proper application of the law.

The evident interest in Article 55 of the LGPD can be explained by several factors. For example, the entire ANPD is regulated in this article, which aggregates the structure, characteristics, and competencies of the National Authority. Furthermore, the ANPD was established by the Provisional Measure in a significantly different manner from that originally proposed by the LGPD, which undoubtedly attracted a large number of amendment proposals.

It is worth recalling that initially, the National Authority was included in the bill approved in August 2018. However, all provisions related to this body were vetoed by then-President Temer, citing a formal defect. Because the LGPD was of legislative origin, it could not create an executive branch authority without violating the separation of powers. Since the veto had not been materialized, there was an expectation of a Decree or Provisional Measure that simply formalized the creation of the ANPD without including substantive changes. Despite the fact that the former President did indeed issue a Provisional Measure, there was a substantial change in content and format from what was proposed in the MP for the National Authority. The final product diverges significantly from both the originally vetoed ANPD and the models of data protection authorities previously established.

In this sense, it is worth noting that the main modification introduced by the MP was the establishment of the ANPD as part of the direct public administration, integrated into the Presidency of the Republic. Originally, the ANPD had a special autarchic regime, linked to the Ministry of Justice, ensuring functional and financial autonomy. Therefore, the amendment proposals to Article 55 focus primarily on attempting to restore the independence of the ANPD. The concern in this scenario is that a National Authority institutionally and financially linked to the Presidency may lose the necessary autonomy to effectively regulate the LGPD and protect the rights guaranteed by the law.

In summary, the importance of MP 869 is evident, as its text modifies various fundamental aspects of the LGPD and creates the National Data Protection Authority, an essential institution for the effectiveness and proper application of the law. Despite its benefits, the approval of MP 869 drew the attention of lawmakers to the need for changes to the texts of both the LGPD and the MP, and even the Marco Civil da Internet. In general, some of the individual rights guaranteed by the LGPD lack specifications, but the amendment proposals demonstrate particular concern with the right to review fully automated decisions.

Regarding the creation of the ANPD, the approval of MP 869 allowed for executive branch interference in the regulatory authority. This is because, under the current wording of the MP, the National Authority is subordinated to the Presidency and has no separate financial resources. In this regard, the amendments to Article 55 of the LGPD ensure the independent functioning of the ANPD.

Thus, the merits of MP 869 in addressing issues originating from the LGPD and specifying certain individual rights should be recognized. However, this does not exempt the Provisional Measure from flaws. The amendment proposals analyzed address the problems created by the Provisional Measure. In most cases, the amendments seek to align the legislation with the principles enumerated by the LGPD itself, including informational self-determination, transparency, and human rights. The review by natural persons for fully automated decisions and the functional and financial autonomy of the ANPD are crucial points for the proper functioning of the General Data Protection Law.

*Co-authored with Bárbara Emidio Nascimento and Juliana da Cunha Mota. Originally published in JOTA.