If you’re familiar with GDPR and CCPA then you should be aware of Brazil’s new general data protection law, the LGPD, and understand that it could affect your institution when handling students’ personal data in the near future. 


The LGPD came into effect on August 15 2020, so here are the key changes and how they apply to universities and colleges.

Does the LGPD apply to our students?

In a nutshell, yes. 

Much like the GDPR, the General Law for the Protection of Personal Data (LGPD) applies to all sectors of the economy, and it is mandatory not only for Brazilian companies but also for foreign companies that operate within Brazilian borders. It applies to:

  • Data processing within the territory of Brazil

  • Data processing of individuals who are within the territory of Brazil, regardless of where in the world the data processor is located (i.e. international students coming from Brazil)

  • Data processing of data collected in Brazil

The main goal of the LGPD is to guarantee the privacy and safety of personal data. It applies to both online and offline processing of data, and to the private and public sphere.

Although penalties and sanctions for non-compliance with the LGPD will not be enforced until August 1 2021, organizations that are already subject to GDPR should review their privacy policies and procedures and revise them as necessary for the LGPD. 

Similar to GDPR and CCPA, the LGPD also provides individuals with the right to request information about the data that is collected from them, so you need to be ready. 

What does the LGPD regulate?

The LGPD regulates the collection and use of ‘personal data’, defined broadly as information relating to an identified or identifiable natural person, in both digital and non-digital form. 

Unlike many other privacy laws, the LGPD does not have a single definition of ‘personal data’, but instead takes a broad view of what qualifies, even more expansive than the GDPR. 

The LGPD further regulates ‘sensitive personal data’, which is defined as data relating to:

  • Racial or ethnic origin

  • Religious belief

  • Political opinion

  • Union membership

  • Philosophical or political organization

  • Health

  • Sexual orientation

  • Genetic or biometric data

There are notable exceptions to the law’s application to personal data, much like the GDPR. However, the LGPD generally does not apply to:

  • Data processed by a person for strictly personal purposes

  • Data exclusively for journalistic, artistic, literary or academic purposes

  • Data exclusively for national security, national defence, public safety, criminal investigations or punishment activities

Data held for your institution’s normal administration activities such as holding a register of students and charging fees should be covered under ‘academic purposes’, as in the GDPR.

However, the maximum fine for infractions under LGPD is 2% of a private legal entity’s revenue in Brazil. So, it’s important to be sure that your institution is compliant to avoid sanctions.

How does the law affect prospective students? 

Under the LGPD, students that reside in Brazil may be entitled to know the categories of information collected and even access the specific information an institution has on them. They can:

  • Access their data

  • Correct incomplete, inaccurate or out-of-date data

  • Anonymize, block or delete unnecessary or excessive data or data that is not being processed in compliance with the LGPD

  • Port their data, i.e. hand it over to another service or processor if requested

  • Have their data deleted

  • Access information about public and private entities with which the controller has shared data

  • Access information about the possibility of denying consent and the consequences

  • Revoke consent

How Akero can help you run compliant, ethical, effective campaigns

We’re always talking about how you should be collecting and maximizing your data to target, engage and convert students. But in recent years, a series of regulations and seismic changes to how data is handled and processed have forced every student specialist marketer to rethink how they use consumer data.

Many marketers are concerned about how they can effectively remarket to prospects at the top and middle of their funnel, or how they can block existing students from receiving advertising and wasting spend. Access to audience lists is going to become increasingly tricky (and potentially expensive) if you are not capturing and using your own first-party data, or using a specialist adtech platform like Akero.

 

So what are the next steps?

The LGPD still has a number of significant uncertainties, however, institutions that process the personal data of Brazilian citizens will be bound to comply with the LGPD regardless of where they are based. Make sure you’re following best practice under all relevant legislation to avoid any issues or even a hefty fine.

Here at Net Natives, we’ll be continuing to keep an eye on how this unfolds for the rest of 2020 and beyond. To speak to our experts about how we can help you run compliant, effective campaigns, contact us today. 

 

Article by

Kevin Hsu Author Image

Kevin Hsu

Marketing Executive