Privacidade e Proteção de Dados Pessoais: In company para o TCM/PA

Centro DTIBR was chosen to deliver privacy and personal data protection training to the staff of the Court of Accounts for the Municipalities of the State of Pará – TCM/PA.

Aware of the responsibility of this task, we built a 40-class-hour course focused on the reality of a Court of Accounts, comprising 30 hours of theory and practice and 10 hours of workshop, with the students themselves taking the lead. We also prepared an extensive dossier for the practical module of the course, describing a fictitious institution designed by Centro DTIBR to simulate the day-to-day operations of a Court of Accounts. Based on this institution, the course participants, divided into work teams, were challenged to draw up a Preliminary Map of the Personal Data Flow, duly adapted to that institution. All of this took place in a controlled environment, under the close supervision of Centro DTIBR's Team of Teaching Assistants.

At the end of the course, participants had the opportunity to present the results of their work live to the other participants and to external guests, respected specialists in the field. This made it possible to gather qualified and impartial feedback.

See the bios of the faculty and teaching assistants by clicking here.

The course followed the Centro DTIBR method, already tested in numerous courses and activities involving hundreds of people in the private sector and public service, and which has received excellent reviews. Learn more about this method by clicking here.

Workload

40 class hours.

Online, via the Zoom Meetings platform.

Staff of the Court of Accounts for the Municipalities of the State of Pará – TCM/PA, from a wide range of profiles and areas of work, including councillors, IT professionals, human resources managers and administrative teams from various departments of the Court.

The course comprised 10 class sessions and 05 practical module meetings. Classes took place from 1:00 pm to 4:30 pm (including a 30-minute break) on January 17, 18, 19, 21, 24, 26, 27 and 31 and February 1 and 3, 2022. In addition, there were 05 practical module meetings, from 2:00 pm to 4:00 pm (no break), on January 20, 25 and 28 and February 2 and 4, 2022. Below is a summary of the content covered in each class.

1. 1) Fundamental concepts and processing of special categories of data – January 17; Prof. Leonardo Parentoni

   Information society, the value of personal data, data-driven business; Distinctions between privacy and personal data protection; LGPD (Brazil's General Data Protection Law): summary of the legislative process, controversies and harmonization with other laws; The “data market” in the public and private sectors; Concepts of data, data processing, personal data, sensitive data, public data, publicly accessible data, registration data, metadata, anonymous data, inference; Processing of Special Categories of Data (sensitive data, data of children and adolescents); Case studies (Brazilian and/or foreign) alongside the analysis of each topic.

2. 2) Foundations and principles of personal data processing – January 18; Prof. Leonardo Parentoni

   Foundations of the LGPD: the necessary balance between the rights of the data subject and the “data market”; Principles of personal data processing - part 1: purpose, adequacy, necessity; Principles of personal data processing - part 2: free access by the data subject, data quality, transparency; Principles of personal data processing - part 3: security and prevention, privacy by design and by default; Principles of personal data processing - part 4: non-discrimination, profiling, credit scoring and cases of legally authorized discrimination; Case studies (Brazilian and/or foreign) alongside the analysis of each topic.

3. 3) Parties involved in personal data processing – January 19; Professor Bruno Vieira

   Data subject; Controller; Processor; Data protection officer (DPO); Civil liability regime for processing agents and the data protection officer; Burden of proof, right of recourse, exclusions from civil liability; Collective redress; Case studies (Brazilian and/or foreign) alongside the analysis of each topic.

4. 4) Legal bases (grounds for processing personal data) – January 21; Prof. Leonardo Parentoni

   Rationale common to all legal bases, absence of hierarchy, accountability; Legal bases – part 1: consent; Legal bases – part 2: compliance with a legal or regulatory obligation, studies carried out by a research body, performance of a contract or preliminary procedures, regular exercise of rights in proceedings; Legal bases – part 3: protection of life or physical safety, protection of health; Legal bases – part 4.1: legitimate interest; Legal bases – part 4.2: legitimacy test (art. 10), processing of special categories (sensitive data, children and adolescents); Case studies (Brazilian and/or foreign) alongside the analysis of each topic.

5. 5) Rights of the personal data subject – January 24; Professor Cíntia Rosa

   Introduction: individual and collective protection, deceased persons, legal entities, entities without legal personality, end of processing and applicable measures; Data subject rights – part 1: confirmation, access, correction (distinction from habeas data); Data subject rights – part 2: information on sharing, consent, refusal to consent, withdrawal of consent; Data subject rights – part 3: anonymization, blocking or deletion (differences from the right to be forgotten); Data subject rights – part 4: portability; Data subject rights – part 5: review of automated decisions; Procedure for exercising these rights, deadlines and forms of response, measures in case of data sharing, role of the ANPD (Brazil's National Data Protection Authority); Case studies (Brazilian and/or foreign) alongside the analysis of each topic.

6. 6) Data protection, human resources and employment contracts – January 26; Professor Rômulo Valentini

   Background checks: purpose and limits in case law; Prohibited conduct in job interviews and in public-sector hiring; Main legal bases in employment contracts; Outsourcing in Public Administration in light of the LGPD; Compliance with LGPD principles in employment relationships; Employee data life cycle (including outsourced staff); Technological tools commonly used in employment contracts: limits and harassment prevention; Duties of the data protection officer/DPO and role deviation.

7. 7) Personal Data Protection in the context of a Court of Accounts – January 27; Professor Leonardo Parentoni

   The role of a Court of Accounts in light of the LGPD; Introduction to risk analysis and risk maps; Some important regulations on the subject: a critical view and points of attention; Issues concerning the data protection officer and the “privacy team”: who can and cannot be the officer, possible formats, how to select, how to appoint, conflicts of interest, and particularities in public service; Main stages of compliance: practical aspects and points of attention.

8. 8) Technology and information security applied to personal data protection – January 31; Professor Bruno Oliveira + Professor Yuri dos Santos

   Fundamental computer science notions related to the topic; Privacy in Law and in Computer Science (differential privacy); Computer networks; IP, TCP, UDP and HTTP protocols, network masks, DNS; Autonomous system administrators; hashing, encryption and digital certification; Basic concepts of web systems, data storage technologies, SQL and NoSQL; Information security and good practices; Security incidents; Case studies (Brazilian and/or foreign) alongside the analysis of each topic.

9. 9) Sanctions under the LGPD – February 1; Professor Laiane Fantini

   Accountability and the rationale of the sanctions provided for in the LGPD; Types of sanctions provided for in the LGPD; Relevant regulatory gaps in the LGPD (comparison with international laws); Grading of penalties and how they are applied; LGPD sanctions versus the Marco Civil da Internet (Brazil's Internet Civil Rights Framework); Application of sanctions against public authorities.

10. 10) Public Authorities and the National Data Protection Authority - ANPD – February 3; Professor Leonardo Parentoni

    Particularities of data processing by public authorities; National Data Protection Authority: structure, function, importance, powers, legislative process, regulatory and sanctioning activity; ANPD goals for the 2021-2022 biennium; Inter-institutional action by the ANPD and possible conflicts of jurisdiction; National Council for Personal Data Protection and Privacy – CNPD; Case studies (Brazilian and/or foreign) alongside the analysis of each topic.

The sessions in which the course participants themselves applied the knowledge in practice took place in dedicated meetings, in the so-called “practical module”. In fact, the whole focus of the course is on practice. What sets this module apart is that in it the students themselves, organized into Teams, were able to “roll up their sleeves” and actually build a Preliminary Map of the Personal Data Flow.