Privacidade e Proteção de Dados Pessoais: In company para o TJMG

Centro DTIBR was honored to be chosen to offer its traditional training course on privacy and personal data protection to one of the most important legal institutions in Brazil, the Minas Gerais State Court of Justice – TJMG.

After months of planning, we built a tailor-made course of 40 class hours, focused on the reality of a State Court of Justice. Among other distinctive topics, we carefully analyzed CNJ (Brazil's National Council of Justice) Resolution No. 363/2021, which set out the guidelines for courts to comply with the General Data Protection Law (LGPD, Brazil's Lei Geral de Proteção de Dados). In addition, we put together an extensive dossier for the practical module, describing a fictitious institution created by Centro DTIBR to simulate the day-to-day operations of a State Court of Justice. Based on this institution, the course participants, divided into work teams, were challenged to draw up a Summary Plan for the Prevention of and Response to Security Incidents involving personal data, duly adapted to that institution. All of this took place in a controlled environment, under the close supervision of the DTIBR Team.

At the end of the course, participants had the opportunity to present the results of their work live to the other participants and to external guests, respected specialists in the field. This made it possible to gather qualified and impartial feedback.

See the faculty bios on the Centro DTIBR website by clicking here.

The course followed the Centro DTIBR method, already tested in numerous courses and activities involving hundreds of people in the private sector and public service, and which has always received excellent reviews. Learn more about this method by clicking here.

Workload

40 class hours.

Venue

Online, via the Zoom Meetings platform.

Staff of the Minas Gerais State Court of Justice – TJMG, from a wide range of profiles and areas of work, including appellate judges, judges, IT professionals, lawyers, human resources managers, the innovation team and administrative teams from various departments of the Court.

The course comprised 10 class sessions and 05 practical module meetings. Classes took place on Mondays and Wednesdays, from 7:00 pm to 9:50 pm, on May 10, 12, 17, 19, 24, 26 and 31 and June 2, 7 and 9, 2021. In addition, there were 05 practical module meetings, always on Fridays, on May 14, 21 and 28 and June 11 and 18, 2021, from 7:00 pm to 8:40 pm.

Below is a summary of the content covered in each session.

1. 1) Fundamental concepts and processing of special categories of data – May 10; Professor Leonardo Parentoni

   Information society, the value of personal data, data-driven business; Concepts of data, data processing, personal data, sensitive data, public data, publicly accessible data, registration data, metadata, anonymous data, inference; Processing of Special Categories of Data (sensitive data, data of children and adolescents); Case studies (Brazilian and/or foreign) alongside the analysis of each topic

2. 2) Principles and legal bases for data processing – May 12; Professor Leonardo Parentoni

   Principles of personal data processing: purpose, adequacy, necessity, free access by the data subject, data quality, transparency, security and prevention, privacy by design, non-discrimination, profiling, credit scoring and cases of legally authorized discrimination; Legal bases: rationale and function of the concept; Consent of the data subject; Compliance with a legal or regulatory obligation, studies carried out by a research body, performance of a contract or preliminary procedures, protection of life or physical safety, protection of health; Regular exercise of rights in judicial, administrative or arbitration proceedings; Legitimate Interest; Proportionality test for legitimate interest; Processing of special categories (sensitive data, children and adolescents); Case studies (Brazilian and/or foreign) alongside the analysis of each topic

3. 3) Analysis of CNJ Resolution No. 363/2021: Guidelines for courts to comply with the LGPD – May 17; Professor Ana Luiza Zakur

   Context in which CNJ Resolution No. 363/2021 emerged; Objectives, targets and bodies covered; Personal Data Protection Steering Committee – CGPD; Officer in charge of personal data processing – DPO; Multidisciplinary Technical Working Group; Compliance map (art. 2); Implementation of security measures; Open dialogue for control and oversight; Contract review

4. 4) Scope of the LGPD – May 19; Professor Leonardo Parentoni

   Foundations of the LGPD: protection of the data subject and preservation of economic activities; Territorial Scope and Extraterritoriality; Material Scope (matters covered and not covered by the law); Subjective Scope (who is subject to the LGPD); Small businesses and pre-existing databases; Case studies (Brazilian and/or foreign) alongside the analysis of each topic

5. 5) Parties involved in personal data processing – May 24; Professor Bruno Vieira

   Data subject; Controller; Processor; Data protection officer; Civil liability regime for processing agents and the data protection officer; Burden of proof, right of recourse, exclusions from civil liability; Collective redress; Case studies (Brazilian and/or foreign) alongside the analysis of each topic

6. 6) Technology and information security applied to personal data protection – May 26; Professor Bruno Oliveira; Professor Yuri dos Santos

   Basics of symmetric and asymmetric cryptography and cryptographic hashing; Basic concepts of web systems and data storage technologies; Information security and security incidents in light of the LGPD; Case studies (Brazilian and/or foreign) alongside the analysis of each topic

7. 7) Data subject rights – May 31; Professor Bruno Oliveira; Professor Yuri dos Santos

   Introduction: individual and collective protection, deceased persons, legal entities, entities without legal personality; Data subject rights – part 1: confirmation, access, correction (distinction from habeas data); Data subject rights – part 2: information on sharing, consent, refusal to consent, withdrawal of consent; Data subject rights – part 3: anonymization, blocking or deletion (differences from the right to be forgotten); Data subject rights – part 4: portability; Technical basics of machine learning; Automated decisions, review and the right to explanation: computational and legal issues; Procedure for exercising these rights, deadlines and forms of response, measures in case of data sharing, role of the ANPD (Brazil's National Data Protection Authority); Case studies (Brazilian and/or foreign) alongside the analysis of each topic

8. 8) Data Protection, Human Resources and Employment Contracts – June 2; Professor Rômulo Valentini

   Background checks: purpose and limits in case law; Prohibited conduct in job interviews; Main legal bases in employment contracts; Compliance with LGPD principles in employment relationships; Employee data life cycle; Technological tools commonly used in employment contracts: limits and harassment prevention; DPO duties and role deviation

9. 9) Data Processing by Public Authorities and the National Data Protection Authority - ANPD – June 7; Professor Leonardo Parentoni

   Particularities of data processing by public authorities; National Data Protection Authority: function, importance, powers, legislative process, regulatory and sanctioning activity; Current stage of the ANPD and goals for the next two years; Inter-institutional action by the ANPD and possible conflicts of jurisdiction; Case studies (Brazilian and/or foreign) alongside the analysis of each topic

10. 10) Sanctions under the LGPD – June 9; Professor Laiane Fantini

    Accountability and the rationale of the sanctions provided for in the LGPD; Types of sanctions provided for in the LGPD; Relevant regulatory gaps in the LGPD (comparison with international laws); Grading of penalties and how they are applied; LGPD sanctions versus the Marco Civil da Internet (Brazil's Internet Civil Rights Framework); Application of sanctions against public authorities

The sessions in which the course participants themselves applied the knowledge in practice followed the schedule below.

1. 1) Team Meeting – May 14

   Presentation by the Centro DTIBR Team of the objectives, deadlines and “deliverables” of the practical module; Information about the draft documents (templates) provided in the course's supplementary material; Introduction of the course teaching assistants and Q&A; Division of students into Teams and first meeting in each Team's private room, so that its members could introduce themselves and get settled; Careful reading of the Practical Module Dossier, followed by each Team defining its strategy

2. 2) Team Meeting – May 21

   Formation of the Internal Data Protection Committee, made up of all Team members, and definition of each member's role; Mapping of the 03 main personal data processing operations routinely carried out by the target institution, stating for each of them: a) the department where they take place; b) the types of data involved (e.g. sensitive data, data of children and adolescents, employee data, etc.); c) the legal bases supporting them; d) who is responsible for the processing in each of them

3. 3) Team Meeting – May 28

   Identify who is the controller, the processor and the data protection officer (DPO) at the target institution; Choose 03 of the types of security incident described in the base case, stating which institutional-culture, computational and legal measures could be used to prevent these incidents and mitigate their damage; For each of the 03 types of security incident chosen, list the notifications that must be made if the incident actually occurs, stating: a) who will be responsible for making each of them; b) who the recipients will be; c) through which channel the notifications should be sent; and d) the deadline for making them; Consider both mandatory and optional/recommended notifications

4. 4) Team Meeting – June 11

   Choice of 03 situations among the types of data subject rights mentioned in the base case in order to explain, based on them: a) whether the request actually has grounds in the LGPD; b) which LGPD provision(s) serve as grounds; and c) if there are grounds in the LGPD, which procedures should be adopted to properly fulfill each of these rights; Finalization of the Summary Plan for the Prevention of and Response to Security Incidents involving personal data, and saving a copy of this document for the Team; Submission of the Summary Plan to Centro DTIBR; Group rehearsal of the presentation to be given live at the last meeting of the course

5. 5) Team Meeting – June 18

   Live presentation of the document produced by each Team, taking on board the suggestions and answering the questions of the invited specialists, who acted as external evaluators, simulating a real situation of scrutiny regarding the document; Closing of the course