Consumer protection entities, data protection specialists, political parties, class entities and even National Telecommunications Agency (Anatel) expressed concern about the text of the Provisional Measure 954 / 2020, published last week.
The action, authored by President Jair Bolsonaro, determines that the telecommunications companies deliver customer data (name, address and telephone number) to individuals and companies so that IBGE can carry out the Continuous National Household Sample Survey (Pnad) - the statistical survey by sample that evaluates important criteria, such as unemployment, for policy purposes macroeconomic.
The justification of the federal government is that with the new coronavirus pandemic, IBGE researchers would be unable to personally visit the homes to collect the data - and for that reason they would have to be collected by telephone for the purposes of “official statistical production”.
MP hurts basic privacy principles
In a note, the Brazilian Institute for Consumer Protection (Idec), states that “the transfer of personal data from telecommunications operators to IBGE does not meet basic principles of privacy provided for in General Law on Data Protection (LGPD), such as defining the specific purpose and the need for the transfer of information ”. Earlier this week, the Brazilian Bar Association (OAB) and the PSDB, PSOL and PSB parties appealed to the Federal Supreme Court (STF) to try to revoke the measure.
Idec classifies as “extremely worrying” some of the gaps observed in the text of the Provisional Measure. For Data Privacy Brasil's research coordinator, Rafael Zanatta, despite the fact that the MP was built based on some safeguards - how to assign data confidentially and set deadlines for making it available and discarded - the measure has fundamental problems.
The most serious of these, according to Zanatta, is the very lack of confidence that these safeguards will be respected. “There is no supervisory mechanism in the text. And this would be the National Personal Data Protection Authority, foreseen in the LGPD, but which the federal government has not yet created, even after almost a year after the law was passed ”, explains Zanatta.
This is also one of the points noted by Idec in its statement, in which it states that "although the MP envisages the preparation of an impact report on personal data", it is "extremely important" to appoint a person in charge.
Accordingly, the president of Anatel, Leonardo de Morais, also stressed that the rules of the LGPD, “although it has not yet fully entered into force, must be observed”, especially where it highlights the “prohibition of transferring personal data to entities private ”.
Other points criticized by the MP refer to the absence of a specific purpose for the treatment of personal data and its disproportionate collection. Although the request is justified by stating that they are “the same ones that were previously published in the 'yellow pages'” - as stated in a letter signed by former presidents of IBGE, alerting Congress and the Judiciary about a possible “statistical blackout” - Idec evaluates the order as “disproportionate”, since the survey is traditionally done by sampling.
“It is unjustifiable to transfer the data of all users of mobile and fixed telephony services, when the need is for a sample survey. For this reason, the IBGE should require from operators only specific data and according to the sample required for each survey, a way to minimize risks to consumer privacy and to be in line with the LGPD, which determines the principle of the need for collection data, ”says Idec.
"The IBGE itself could determine a random sampling by region, which would be requested from the operators and kept in a secondary database", suggests Zanatta. By not individualizing the information, and using an outsourced partner, “with a mega call center structure”, the companies' database would be more protected, according to the coordinator.
The MP also determines that the shared data “will be used directly and exclusively by the IBGE Foundation for official statistical production”, which according to the experts is a very generic term. “It is necessary to determine the collection for the specific purpose of carrying out the National Household Sample Survey (PNAD) with a focus on Covid-19, as determined by the LGPD”, adds Idec.
The security of these data, even within government agencies, is also an object of concern. Zanatta points out that there are federal laws that aim to reduce barriers between public administration bodies in the exchange of citizens' data. “Even though the text of the MP states that the data are exclusive to IBGE, under the legislation, the agency has an obligation to share information with other entities. This shows how the situation is vulnerable from a legal perspective, because this MP would be on a collision course with other rules ”, he adds.