May 22, 2023
ANPD Publishes Opinion Regarding Use of Data in the Pharmaceutical Sector
Authors:
The Brazilian Data Protection Authority (ANPD) published Opinion n. 4/2022/CGTP/ANPD (“the Opinion”), shedding light onto a series of findings on the use of personal data in the pharmaceutical sector.
The Opinion focused on some sensitive points in the sector, such as loyalty programs and discounts, where a massive amount of potentially sensitive data is gathered and disclosed to various agents. The Opinion also identified potential compliance flaws of certain agents in the sector—though the Opinion is not related to an investigation.
The Opinion reveals some of the ANPD's positions worth highlighting. First, the ANPD will evaluate privacy policies randomly on the Internet and it expects to find information regarding lawful bases, even though Article 9 of Brazil’s General Data Protection Law (the LGPD, Law No. 13,709 of 2018) does not expressly require such information to be disclosed. Additionally, if personal data is collected in person—as is the case when registering in stores—the privacy policies and notices must also be made available in person to the data subjects, by the same means through which the data is collected.
The Opinion also recommends that when there is a discount, loyalty, or other program, specific regulations should be published in an easily accessible place. This point is not new, but demonstrates what the ANPD will analyze in its investigative procedures. In this sense, making disclosure of personal data a condition of obtaining discounts in a loyalty/discount program may render consent invalid, mainly due to (i) lack of transparency as to the reason why the data subject is sharing their data at the time of purchase and (ii) lack of freely given consent.
Lastly, we can infer from the Opinion that, when collecting biometric data for identity validation purposes, if there are other, less invasive—and safer—means, one should always opt for not collecting biometric data, as determined by the minimization principle, set forth in Article 6, Item III of the LGPD.
It is important to note that this is not a binding opinion with regard to the above positions, but it should certainly serve as a guide to best practices for the regulated entities.
The Opinion focused on some sensitive points in the sector, such as loyalty programs and discounts, where a massive amount of potentially sensitive data is gathered and disclosed to various agents. The Opinion also identified potential compliance flaws of certain agents in the sector—though the Opinion is not related to an investigation.
The Opinion reveals some of the ANPD's positions worth highlighting. First, the ANPD will evaluate privacy policies randomly on the Internet and it expects to find information regarding lawful bases, even though Article 9 of Brazil’s General Data Protection Law (the LGPD, Law No. 13,709 of 2018) does not expressly require such information to be disclosed. Additionally, if personal data is collected in person—as is the case when registering in stores—the privacy policies and notices must also be made available in person to the data subjects, by the same means through which the data is collected.
The Opinion also recommends that when there is a discount, loyalty, or other program, specific regulations should be published in an easily accessible place. This point is not new, but demonstrates what the ANPD will analyze in its investigative procedures. In this sense, making disclosure of personal data a condition of obtaining discounts in a loyalty/discount program may render consent invalid, mainly due to (i) lack of transparency as to the reason why the data subject is sharing their data at the time of purchase and (ii) lack of freely given consent.
Lastly, we can infer from the Opinion that, when collecting biometric data for identity validation purposes, if there are other, less invasive—and safer—means, one should always opt for not collecting biometric data, as determined by the minimization principle, set forth in Article 6, Item III of the LGPD.
It is important to note that this is not a binding opinion with regard to the above positions, but it should certainly serve as a guide to best practices for the regulated entities.
Authors
Stay Up To Date With Our Insights
See how we use a multidisciplinary, integrated approach to meet our clients' needs.
Subscribe