The Brazilian Data Protection Authority (“ANPD”) published on Wednesday, May 24, the Statement CD / ANPD 1, according to which the processing of personal data of children and adolescents may be carried out based on any of the legal hypotheses provided for in articles 7 and 11 of the Brazilian General Data Protection Law (Federal Law n. 13,709/2018 or “LGPD”).

According to the statement, "the processing of personal data of children and adolescents may be carried out based on the legal hypotheses provided for in article 7 or in article 11 of the Brazilian General Data Protection Law (LGPD), provided that their best interest is observed and prevails, to be evaluated in the specific case, under the terms of article 14 of the Law."

Until this official understanding, there was a controversy over the interpretation of the necessity of the consent defined in article 14, paragraph 1. There were questions as to whether the consent was the only legal hypotheses to support the processing of children's data (under 12 years old) or whether other legal hypotheses of the law (Articles 7 and 11) would also apply to the processing of personal data of children.

The text of Art. 14, §1°, reads as follows: "The processing of personal data of children shall be carried out with the specific and highlighted consent given by at least one of the parents or the legal guardian."

Since the LGPD expressly mentions the need for consent for processing children's data, there was an uncertainty about the possibility of applying the other legal hypotheses. The questioning took place especially in situations in which the practical routine of the companies showed that the risks of processing children’s personal data were small and that it was made for the benefit of the child or adolescent. This is the case, for example, of the inclusion of dependent children for health insurance or for the participation in events at the parent’s company.

The text of the LGPD itself enhances the discussions by indicating an exception provided for in paragraph 3 of the same Article 14. In accordance with this paragraph, personal data of children may be collected without the referred consent of paragraph 1, if there is a need to contact the parents and legal guardians or for the protection of the child. This paragraph also establishes that the personal data of the child may only be collected to be used once and may not be stored or shared with third parties without consent.

The need for consent for these situations causes an undeniable burden for the company that, as data controller, has the duty to collect the consent diligently and to ensure the right of the data subjects to withdraw their consent and store the given consent for accountability purposes (Article 8, paragraph 2, LGPD).

The legislation evaluates the risks that the processing of personal data usually causes in order to define the obligations of companies. Accordingly, the higher the risk, the greater the obligations. Due to that, for example, the legislation distinguishes personal data and sensitive personal data and also defines that data breaches must be informed to the ANPD and to the data subjects since they can cause relevant risks and damages (Article 48, LGPD).

Other public debates also brought this possibility of applying other legal hypotheses to the processing of children’s data, such as Statement 684 of the decision of Civil Law of the Council of Federal Justice, approved in 2022. According to the statement: "Article 14 of Law No. 13,709/2018 (Brazilian General Data Protection Law - LGPD) does not exclude the application of other legal hypotheses, if applicable, taking into account the best interest of the child."

In this context, the new statement of the ANPD is equitable and pursuant to the reality. In addition, the statement reinforces the need for the data controller to be more diligent when evaluating and documenting the best interest of the child and adolescent in the processing activity and electing the appropriate legal hypotheses of articles 7 and 11 of the LGPD.

The statement is binding, especially considering Article 55-J, XX (LGPD), which establishes that the ANPD is responsible for determining the interpretation of the law. All companies must follow the statement’s rules from the date of its publication – May 24, 2023. The companies must, at a minimum:

• re-evaluate their processing activities and data mappings which include personal data of children and adolescents.

• re-evaluate the legal hypotheses for these activities as appropriate and stop using the consent when unnecessary.

• review their privacy policies and agreements, updating the specific sections dedicated to the consents of those data subjects, when applicable.

• evaluate and document the presence of the best interest of children and adolescents for each activity and be prepared to account for the legal hypotheses chosen for data subjects and authorities; and

• maintain the consents collected between the effective date of the law and May 23, 2023, to preserve their liability until the publication of a new statement.