art. 4. Regulation on the implementation of Law 13.709 of August 14, 2014, the General Law on Personal Data Protection (LGPD) for small processing agents, approved by Resolution CD/ANPD no. 2 of January 27, 2022, criteria are provided for defining high-risk treatment for the data subject, as follows:
Art. 4 For the purposes of this regulation, and without prejudice to the provisions of Art. 16, the processing of personal data that cumulatively meets at least one general criterion and one specific criterion, among those listed below, will be considered high-risk:
I – general criteria:
a) extensive processing of personal data; or
b) processing of personal data that can significantly affect the interests and fundamental rights of the holder;
II – special criteria:
a) use of new or innovative technologies;
b) supervision or control of areas accessible to the public;
c) decisions made solely on the basis of automated processing of personal data, including those aimed at defining the personal, professional, health, consumer and credit profile or aspects of the holder’s personality; or
d) use of sensitive personal data or personal data of children, adolescents and the elderly.
§ 1 The processing of personal data on a large scale will be characterized when it covers a significant number of data subjects, also taking into account the amount of data involved, as well as the duration, frequency and geographical scope of the treatment carried out.
§ 2 The processing of personal data that can significantly affect the interests and fundamental rights will be characterized, among other things, in situations where the processing activity can prevent the exercise of rights or the use of the service, as well as cause material or moral damage to the holders, such as discrimination, violation of physical integrity, rights to image and reputation, financial fraud or identity theft.
§ 3 ANPD can provide guides and guidelines to help small treatments in the assessment of high-risk treatments.
In order to bring more clarity to the definition of high-risk processing for processors and data subjects, ANPD is preparing a guide with guidelines that can help assess small processors in relation to the processing of personal data they have carried out.
It is important to note that, among the different criteria for defining a high-risk treatment, it is observed that a large scope can be one of the criteria that can facilitate the assessment of the performed treatment for the agent, taking for this purpose the scope of a significant number of subjects, the volume of included data, as well as the duration, frequency and geographical scope of processing.
Therefore, in order to support the preparation of the ANPD guide on the high-risk treatment of holders, the ANPD conducts this research on subsidies for agents and specialists for personal data processing through questions related to the topic.
Participation in counseling must take place through answers to the questions listed below, exclusively through the Participa + Brasil Platform. TO OPINION, YOU MUST REGISTER AND BE LOGGED IN TO THE PLATFORM.
ANPD welcomes all contributions to any of the questions below and is not required to answer all questions.
The questionnaire is organized in two parts. Part 1 is intended for personal data processing agents, and Part 2 is intended for the general public.
If you would like to share reports, images or attachments, please send an email firstname.lastname@example.org the consultation period, referring to “Research to define high-risk treatment” in the email subject.
Do not email answers to questions; only contributions with complementary materials to the answers to the questions are accepted.
*ATTENTION* Each user can submit their answer only once, considering that the platform does not allow more than one contribution per user. We therefore suggest that all responses be submitted at the same time.