Ariadne Fabiane Velosa and Luara Zanfolin Frasson de Rezende
Lawyer at Marcos Martins Advogados
The LGPD (General Data Protection Law – Law No. 13,709/2018) was created to regulate the processing of personal data in Brazil, both by the Government and by the private sector, with the aim of guaranteeing fundamental rights related to the protection of people’s freedom, privacy and intimacy, allowing data subjects more transparency and control over the use of their data.
Personal data can be understood as any information related to an identified or identifiable natural person, such as name, marital status, address, etc. It should be noted that the list is not exhaustive, as new behaviors may arise related to data processing and the purpose of the LGPD.
Thus, considering that in employment relationships there is a great deal of traffic in this type of information, it is necessary for any and all companies to comply with the LGPD.
This is because the employer, whether a natural or legal person, is the operator and controller of the data, while the employee or service provider is the holder of the personal data, whether sensitive or not.
In this case, it is important to note that the employer will have to adapt internally, but also externally, insofar as some of the personal data or sensitive personal data is passed on to third parties, such as outsourced companies, health insurance plans, information passed on to e-Social.
Thus, within labor relations, we have identified three moments that should be considered by the employer when processing data: 1. Pre-contractual; 2. Contractual and, 3. Post-contractual.
We can understand the pre-contractual phase as the entire selection process, i.e. vacancy opening, receipt of CVs, screening of CVs, interviews until hiring. This should also include any CV banks held by the employer and the processing of the CVs of candidates who were not selected for the job.
The contractual phase begins with the hiring of the employee or the formalization of a contract with a service provider. From then on, all the data and documents arising from the relationship between the company and the employee will have a greater flow and, therefore, greater caution and care must be taken, with the definition of specific processes and procedures according to the reality of each company.
The post-contractual phase is characterized by an employee leaving the company or dying. It is also necessary to comply with the precepts of the General Data Protection Act.
It is important to say that each company has a different flow of information , depending on its size, number of employees and processes, so there is no rule of processes and procedures that can be implemented by everyone, and internal mapping must be carried out to understand routines, flows, operators, storage, etc.
Based on this mapping, it will be possible to analyze the risks and the need to adapt to the law.
It is important to point out that in the event of non-compliance, article 52 and the following sections of the LGPD provide for administrative penalties that can be applied to the agent who commits data processing infractions, such as warnings, fines or total or partial bans on activities related to data processing.
It should also be noted that the Law itself has been in force since 18/09/2020, however, the validity of the articles that provide for administrative sanctions was postponed until 01/08/2021, in order to allow companies more time to adapt due to the economic consequences created by the Covid-19 pandemic.
It is true that there is a possibility of a further postponement of this deadline to January 2022, since Bill No. 500/21 has been presented. However, it is important that companies take the necessary action as soon as possible to avoid any irregularities and the punishments provided for in the LGPD.
It should also be noted that, although administrative sanctions have been postponed, a survey carried out by the law firm Data Lawyer Insights for the newspaper Valor Econômico found that there were 139 cases involving the LGPD in labor lawsuits as of January this year, with the total value of these cases being R$15 million[1].
For this reason, it is highly recommended that companies seek legal advice on adapting to the legislation, which Marcos Martins Advogados is able and prepared to offer.
Have any questions? Talk to our lawyers and receive guidance.
[1] https://valor.globo.com/legislacao/noticia/2021/01/20/trabalhadores-usam-a-lgpd-para-buscar-direitos-na-justica.ghtml
