A proteção de dados pessoais na administração pública: um estudo do caso do metrô de São Paulo

Abstract

Brazil's General Personal Data Protection Law (LGPD), Law No. 13,709/2018, establishes strict standards for the collection, storage, processing and sharing of personal data, aiming to protect individuals' fundamental rights to freedom and privacy. The public administration, when providing services to the population, must ensure that the processing of citizens' personal data is carried out in accordance with the guidelines established by the LGPD. The implementation of the LGPD in public administration requires the adoption of appropriate technical and administrative measures to ensure the protection of personal data. This includes the need to appoint a data protection officer, carry out data protection impact assessments, create transparent privacy policies and implement information security mechanisms. Furthermore, it is imperative that personal data is only processed for legitimate, specific, explicit and informed purposes to the holders, minimizing the collection and excessive processing of information as much as possible. The LGPD also emphasizes the importance of the data subject's consent, except in situations where processing is necessary to comply with legal obligations, execute public policies or protect the lives and physical integrity of citizens. Therefore, public administration must balance the need for efficiency in the provision of public services with the obligation to protect the privacy of individuals, adopting data governance practices that promote transparency and trust in society. Therefore, the challenge that arises is: how is the processing of personal data granted by the public administration when providing a public service in light of the LGPD?