Introduction
Partial derogation for academic research
Research organisations
Restrictions on legal bases for studies by research organisations
Responsibility for data used
Complying with other laws and regulations
General requirements for conducting studies
Comment
On 3 May 2022, the National Data Protection Authority (ANPD) released a technical study titled "The LGPD and personal data processing for academic purposes and studies by research organisations". The study evaluated a special framework within the General Data Protection Law (LGPD) that applies to data processing exclusively for academic purposes, as well as to certain aspects of data processing by research organisations. The study focuses on the following points:
- the definition and scope of the concepts "data processing exclusively for academic purposes" (article 4, II, b) and "research organisation" (article 5, XVIII) in the LGPD;
- the legal basis for authorising personal data processing for research purposes (particularly article 7, IV and article 11, II, c of the LGPD); and
- a researcher's defined responsibilities and the appropriate method for proving their identity and relationship with research organisations, which is necessary for accessing and obtaining personal data to conduct studies.
According to the ANPD, the study was developed to address questions that have been frequently raised by different actors, including:
- the judiciary;
- universities;
- research institutes; and
- researchers.
As such, the study has established some important preliminary understandings to ensure that the LGPD's provisions are properly observed. These key aspects are outlined below.
Partial derogation for academic research
The ANPD's study has established that the LGPD (article 4, II, b) provides for partial derogation when data processing is carried out exclusively for academic purposes. This article should be subject to restrictive interpretation and limited to situations where personal data processing is strictly linked to exercising academic freedom.
Even in this scenario, data processing must be supported by one of the legal bases provided for in the wording of the LGPD. Going beyond the LGPD's text, the study clarifies that other provisions may also apply (such as articles 6, 8, 10, 12 and 13). However, the study does not indicate all possible provisions that could apply to this situation.
In defining the concept of "research organisation", the ANPD's study affirms that for-profit legal entities governed by private law are excluded from the list of processing agents that the definition covers. Therefore, these entities are prohibited from using certain specific legal grounds to process data.
Restrictions on legal bases for studies by research organisations
The LGPD's articles 7, IV, and 11, II, c permit data processing for "studies by research organisations, which must guarantee the anonymisation of sensitive personal data whenever possible". These databases cannot be used by for-profit legal entities and individuals acting on their own behalf or without any connection to a research organisation.
However, the ANPD's study recognises that this does not mean such entities are prohibited from processing personal data for study and research purposes – rather, other legal bases should be evaluated in practice (eg, legitimate interest and consent).
The ANPD's study highlights that it is important to correctly identify those authorised to access personal data and conduct studies on behalf of public bodies and entities legitimately recognised as research bodies. Thus, the ANPD recommends entities and bodies that provide access to personal data for studies and research verify the relationship between the researcher and the research body via a "term of awareness and responsibility". This document should certify that the research organisation is aware of the study and that it complies with the LGPD.
Complying with other laws and regulations
Although entities may use one of the legal bases in articles 7, IV, or 11, II, c to exempt themselves from obtaining consent from research participants, this does not remove the need to obtain consent when so required by other applicable legislation and ethical standards.
General requirements for conducting studies
Although article 13 of the LGPD establishes specific requirements for public health studies, the ANPD's study extends the application of this provision. It establishes that studies conducted in other academic fields should also observe the parameters of article 13 as appropriate and align with the specific characteristics of each case.
The study did not include an analysis or interpretation of specific criteria for providing access to or disclosing personal information under Brazil's Access to Information Law (Law No. 12,527/2011). The study also lacks an analysis of standards and techniques used in anonymisation and pseudonymisation processes.
To assist it in creating new guidelines, the ANPD has released its findings to promote public debate and collect contributions from the public. The deadline for submitting comments and suggestions is 3 June 2022.
For further information on this topic please contact Fabio Ferreira Kujawski, Luiz Felipe Di Sessa, Paulo Marcos Rodrigues Brancher or Thiago Luís Sombra at Mattos Filho Veiga Filho Marrey Jr e Quiroga Advogados by telephone (+55 11 3147 7600) or email ([email protected], [email protected], [email protected] or [email protected]). The Mattos Filho Veiga Filho Marrey Jr e Quiroga Advogados website can be found at www.mattosfilho.com.br.
An earlier version of this article was first published on Único.