Alerts
ANPD Cookies and Personal Data Protection
The Brazilian National Data Protection Authority (“ANPD”) published, on October 18, 2022, the guide on “cookies and personal data protection” (“Guide”), which aims to provide an overview of the matter and clarify some questions that remained about the use of cookies in a digital environment.
According to the ANPD, one of the potential problems related to using cookies in a digital environment is the lack of transparency, that is, lack of clear information on the processing of personal data, in breach of one of the basic principles of the Brazilian General Law for the Protection of Personal Data (“LGPD”). Pursuant to transparency principle, data subjects must have clear, easy, and accessible information about the processing of their personal data. Therefore, the ANPD recommends, through the Guide, the draft of a Cookies Policy or an equivalent document to comply with the principle of transparency and free access provided for in the LGPD.
The Cookie Policy must contain information “about the specific purposes that justify the collection of personal data through cookies, the retention period and whether there is sharing with third parties, among other aspects indicated in article 9 of the LGPD”, such as identification and contact information of the data controller and data subjects’ rights. Therefore, besides the principle of transparency, the ANPD pointed out the importance of complying with the other principles of the LGPD, such as purpose limitation, data minimization, and adequacy, that is, preventing the use of personal data through cookies for general purposes, or for later purposes incompatible with the original purpose.
According to the ANPD, there is no specific way for the Cookies Policy to be presented to data subjects. All options are legitimate, thence, they can be presented as a specific section of the privacy notice, or in a specific and separate place, or even in the cookie banner itself. The important is that data subjects are assured of clear, accessible, and easily accessible information, in compliance with the principle of transparency and the other principles set forth under the LGPD.
Moreover, the Guide covers a specific and very illustrative chapter on cookie banners. Pursuant to the ANPD, cookie banners act as “a tool to bring transparency and adherence to the principles of personal data’s protection (…) to inform the data subject, in a summarized, simple, and direct way, about the use of cookies in that environment”. Thus, cookie banners “contribute to the process of conscious decision-making by the data subject, in addition to strengthening control over their personal data and respect for their legitimate expectations”.
Finally, the Guide provides the legal basis that legitimize the processing of personal data through cookies. Among them, the ANPD emphasize the use of consent and legitimate interest, depending on the type of cookies, although the other bases may also apply.
Our Data Protection team remains at your disposal for any questions and clarifications.
