The application of LGPD in agribusiness

The General Data Protection Law (LGPD), in force since September 2020, established standards for the collection, use and storage of personal data, aiming to guarantee the privacy and security of its holders' information. On February 10, the Federal Congress recognized the protection of personal data as a fundamental right and guarantee in the Federal Constitution by promulgating the constitutional amendment on the subject.

The processing of personal data can be seen in different agribusiness activities. The LGPD is applicable regardless of the volume of personal data processed, which is why it may affect several stages of an operation, such as negotiations and transactions of contracts with partners, search for granting rural credit, management of service providers, partnership contracts and leasing, research into technology development, as well as in relations with rural workers, temporary employees hired during harvest times or other activities involving individuals. Likewise, databases that contain identifiable data from natural persons, such as potential customers, intermediaries or employees, must be protected by law.

The use of technologies in the field for the development of agribusiness may also imply the use of information subject to the application of the LGPD. Thus, tools that can capture information or images of people (such as drones, cell phone applications or software) or the use of research on properties, territories, georeferencing, agronomic, financial or precision agriculture data, whenever they involve personal data of a identified or identifiable person, must be preserved by technical and administrative measures that are appropriate to protect the information from undue processing that could characterize a security incident. These measures will protect the privacy of holders of personal data and the confidentiality of companies, since data leaks can be crucial for businesses, quickly damaging their image in the market and consumers.

Among the obligations provided for by legislation, personal data must be used for legitimate purposes and explicitly informed to the holder. That is, data processing involving personal data must be limited to the minimum necessary to achieve its purposes, covering only pertinent, proportional and not excessive data. Likewise, it will be necessary to pay attention to the use of updated data according to the need and to fulfill its purposes, making it impossible to use information for discriminatory, illicit or abusive purposes towards the holder. However, it is worth noting that the use of anonymized data (subject to the use of reasonable technical means available at the time of processing, through which data loses the possibility of association with an individual) will not be subject to such LGPD obligations.

In this scenario, non-compliance with the law may lead to the application of penalties by the National Data Protection Authority (ANPD), reaching up to 2% of gross revenue (limited to R＄ 50 million per infraction), in addition to reputational and potential damage. loss of business in agriculture. Therefore, processing agents in the sector need to be aware of the provisions of the LGPD and quickly ensure the necessary adjustments.

By Renata Luiz, associate lawyer at Trench Rossi Watanabe