A regulação da atividade empresarial em relação à coleta, uso e tratamento de dados

Abstract

The transmission of personal data is an inseparable phenomenon of life in the current stage of society. In order to make purchases, obtain services and even make claims and pleas, it is sometimes necessary to provide data that only concerns the holder. With the advent of the information society and the increase in e-commerce practices, companies have become true managers of databases of significant size. With the possession of these materials, it is possible for the institutions that hold them to practice various acts and influence the behavior of third parties, taking advantage of the power that the information provides. Thus, in accordance with the evolution in the legislative treatment of data protection, it is necessary to better understand the task of regulation in the field of data, since the purely civil and contractual perspective is not able to protect the citizen against harmful practices undertaken by companies regarding personal data, beyond the classic examination of contractual freedom. In this context, law 13.709 of August 14, 2018, called the General Law of Personal Data Protection (LGPD), was approved, which provides for the treatment of this range of data. However, the regulation and enforcement undertaken by the competent bodies is still scarce when compared mainly with the European Union, and problems related to improper data processing still end up in the courts. Therefore, in order to be effective, it is necessary to research the regulation and applicability of similar laws and regulations in other countries with a history of data protection, in comparison with what is also happening in Brazil, with the aim of preventing violations of the rights of data subjects from occurring in the first place. As a next step, a closer relationship with the European regulatory model, with greater concreteness, as well as the implementation of self-regulatory tools, such as compliance, may prove useful in the pursuit of personal data protection, considering that the realization of the corporate purpose is no longer enough for companies, and compliance with the rules and respect for the individual are rigorous. To this end, the hypothetical-deductive method is used, with the aid of bibliographical research as a methodological procedure. The hypotheses are that: 1) the European regulatory paradigm for data protection can be useful for the efficiency of the LGPD, with possible repercussions in reducing litigation by individuals against companies that use data as assets; 2) the adoption of self-regulatory instruments is a suitable tool both for the protection of the individual who holds the data, since it reduces the need to resort to external means of protection, and for the generation of an environment that is consistent with the LGPD and more equitable between economic agents, since information will tend to be more symmetrical between companies and its search less invasive. The topic is part of the area of concentration of Uninove's Master's and Doctorate program (PPGD), which is "Business Law: Structures and Regulation", with a line of research on "transnational companies and regulation".