Possibilidades e Limites da Anonimização de Dados Pessoais

Abstract

According to the Brazilian General Data Protection Law ("LGPD"), anonymized data is not considered personal data. When data no longer allows the identification of the data subject, considering the use of reasonable and available technical means at the time of its processing, it is considered anonymized and, therefore, the LGPD does not apply. This reality allows data anonymization to be used as a way to avoid the incidence of the law, making a better understanding of the subject particularly relevant. The objective of this article is to understand the scenarios in which anonymization can be used and the main applicable legal limitations. This article will analyse the legal hypotheses authorizing anonymization, whether anonymization is a data processing activity, whether it can validate an irregular and former processing, and whether, in the face of a data deletion request by the data subject, the controller can simply anonymize them, avoiding deletion. The analysis will be conducted based on the interpretation of legal texts, with support from legal doctrine. In the end, an understanding of the hypotheses in which anonymization can be adopted as a prerogative of the controller is proposed, maintaining harmony with the interests and rights of data subjects.