Privacidade à exaustão: efeitos e fundamentos da regulação de atividades com dados pessoais

Abstract

The Brazilian data protection law is strongly influenced by the theoretical and normative perspectives that underlie the European General Data Protection Regulation. This influence can be perceived in the definition of personal data and in the openness of the semantic content of this concept, as well as in the fact that both norms are structured upon a set of principles. The Brazilian General Data Protection Regulation (LGPD) enunciates to be founded upon and aimed to protect several fundamental principles, which means it must fulfill the task of balancing them by protecting the different dimensions of freedom they encompass. This study aims at evaluating if, and to which extent, LGPD is capable of promoting balance between those principles in a desirable form. In order to accomplish this, grounded theory has been implemented, in conjunction with a phenomenological approach, to formulate the hypothesis that the right to privacy is disproportionately embedded in the core foundations of LGPD. This has led to an analysis which involves taking into consideration the foundations and objectives of data protection regulation, as well as its effects, starting from the observation of the phenomena it is intended to work upon. The objective of this approach is to better apprehend how the data protection regulation framework might work in order to achieve constitutional objectives and promote an adequate balance amongst them, considering the major importance of data treatment activities in contemporary economy. The study starts with a short discussion on the role of Law in establishing and altering social relations, especially in light of the possible interactions between the Law and other fields of knowledge. Some of the most common ways of conceptualizing data protection problems and regulation are also part of the discussion. The study then analyses the concepts of personal data and of information, as well as its functions in the regulatory framework, and moves to evaluate subjective perspectives of control information and how data protection regulation might or might not work to provide control in different stages of information use. At last, some of the implications of data protection regulation to personal data markets are exposed and discussed, especially in light of discoveries that show increased market concentration as a result of such regulation. It was possible to conclude that the theoretical foundations of Brazilian data protection regulation lead to a kind of intervention that is incapable of effectively approaching and dialoguing with contemporary data treatment activities, which results in poor outcomes for data subjects and treatment agents, as well as for the consistency of data protection theory regulation. The conclusions leave several perspectives open for discussion and research, such as investigations regarding the potentialities of multimodal argumentation in providing better choice-conditions for data subjects; possibilities regarding the structuring of arrangements that provide more meaningful power to data subjects, especially in the later stages of information use; the considering of regulatory and economic structures that favor power dispersion in technology and data markets.