On October 18th, 2022, the ANPD (Brazilian Data Protection Authority) released a Guiding handbook on cookies and the protection of personal data with the objective of helping data controllers and processors regarding good practices in the use of cookies, whilst also painting an overview of the topic, touching on technical and conceptual matters.
The newly released document addresses the rights and obligations of agents involved with data treatment in an educational manner, while also detailing what are cookies, as well as the applicable LGPD (Brazilian General Data Protection Law) principles in such scenarios. The guiding handbook also recommends the fitting instruments to data controllers and processors in an effort to guarantee the law’s effective application through the use of cookie banners and the creation of policies.
Miriam Wimmer, the ANPD’s director and the guiding handbook’s rapporteur, concluded that “the cookies guidelines bring forth important orientations and directives regarding treatment agents’ adequacy to the LGPD’s dispositions (…) its objective is centered around the promotion of the data protection culture in the digital sector, incentivizing the adoption of transparent practices that guarantee the data subjects a bigger comprehension and control over the use of their data”.
The new guiding handbook clearly admits the use of the controller’s or third party’s legitimate interest as a legal basis when using cookies:
“In general, legitimate interest may be the appropriate legal hypothesis in cases of use of cookies that are strictly necessary, i.e., those that are essential for the proper provision of the service or for the operation of the website, which can be understood as a form of support and promotion of the activities of the controller and the provision of services that benefit the holder (Art. 10, I and II, LGPD).”
There were quite a few reservations regarding the use of legitimate interest as a data basis, in many cases prioritizing the subjects’ consent — which generates significant doubts, considering the obligation that consent must be, among other aspects, freely given. The analysis of the use of cookies, however, must consider the peculiarities of each concrete situation and evaluate whether the subjects’ rights and interests should prevail, considering the LGPD’s dispositions. It is important to note that the ANPD does not recommend the use of the legitimate interest as a legal basis regarding publicity/advertising cookies.
Another aspect worth emphasizing regarding the directives are the scope of their applicability. The document itself assures that “despite the Guiding handbook having data collection through the use of cookies as its main focus, the directives here present are also applicable, generally, to personal data collection via the use of technologies similar to tracking (including portable devices such as smartphones and tablets), observing the peculiarities of every context)”.
The Brazilian authority highlighted that the correct observance to the guiding handbook’s articles does not exempt the controllers and operators from following other LGPD’s dispositions — which is primordial for conformity, regularity, and the validity of operations. Activities involving the processing of personal data, while also affirming the necessity of adopting the fitting measures that guarantee the protection of data subjects’ rights, are to be compatible with the national legislation.
In a nutshell, the guiding handbook (which can be accessed here, in English), addresses (i) the legal situations for data treatments through the use of cookies, emphasizing consent and legitimate interest; (ii) good transparency practices to be observed for tracking purposes.
The ANPDS’s orientations can have a significant impact in the usage of third-party cookies, such as those used for digital publicity and analytics, while also causing a plausible need for review of cookie banners.
Besides the publication of the guidelines, yesterday also saw the approval of a significant change in the legal regime of the Brazilian Data Protection Authority. The Federal Senate approved yesterday, with the rejection of all the 30 amendments presented, the Provisional Measure No. 1,124/22, which converts the ANPD into an autarchy of a special nature.
The Provisional Measure also changes the commissioned positions of Chief Executive Officer and the head of the Specialized Federal Prosecutor’s Office, with no increase in expenses. In practice, the now special-regime autarchy gains greater autonomy to oversee issues related to data protection, no longer being subordinated to the President of the Republic.
If you want to know more, our team is at your disposal to provide any further clarifications regarding the Brazilian Data Protection Authority’s new orientations.
