The Brazilian Data Protection Authority publishes Technical Note on data processing in the Pharmaceutical sector
Thursday, May 31th, 2023
On May 12th, 2023, the Brazilian Data Protection Authority (ANPD) issued the Technical Note No. 4/2022/CGTP/ANPD which addresses the practices of processing personal data and sensitive personal data carried out by the pharmaceutical sector. The purpose of this disclosure is to monitor the market, develop studies on current practices, encourage good practices, and identify their compliance with the Brazilian Data Protection Law (Lei Geral de Proteção de Dados – LGPD).
The ANPD has been supervising the practice of data processing activities carried out in drug stores and, after receiving complaints from data subjects, initiated studies about the subject through its General Coordination of Technology and Research (Coordenação-Geral de Technologia e Pesquisa – CGTP).
The main findings of the study, demonstrated through practices contrary to the precepts and principles of the LGPD, indicate that most organizations in the pharma industry were in an embryonic state of adaptation to a personal data protection regime. These findings include, but are not limited to:
- Existence of processing of personal data for purposes other than those informed to the data subjects;
- Evidences of extensive collection of personal data;
- Insufficient information given to the data subject as to how their data is being processed, deprived clarity on data processing activities;
- Lack of transparency in how the data is shared with service providers and other commercial partners.
Furthermore, due to the impairment of the right to information resulting from the practices employed by the industry, the ANPD indicated that the data subjects could be the target of price discounts of pharmaceutical products conditioned to the prior processing of personal data, which could also represent a violation of Brazilian Consumer Law.
The Brazilian Authority also highlighted that it is essential to establish a relationship of dialogue and direct supervision with processing agents related to the business models adopted by drug stores – and not only with their representative entities. This relationship would aim to understand in depth the dynamics and purposes of each data processing activity, the security measures adopted, good governance practices, the level of maturity in privacy and data protection, and the specificities of each data processing agent.
The Technical Note demonstrates the preliminary position of the ANPD in relation to the pharmaceutical sector, indicating the importance of monitoring developments and proposals for guiding measures for the industry.
NNB Advogados has a specialized team in privacy and data protection, qualified to assist companies in advisory and litigious demands. To learn more about how we can assist you, please contact us.