The Brazilian National Data Protection Authority (ANPD in Portuguese) published Technical Note No. 4/2023/CGTP/ANPD with findings on the use of personal data in the pharmaceutical sector. This revealed that some personal information processing practices were not yet in full compliance with the General Personal Data Protection Law (LGPD in Portuguese).
The study conducted by the ANPD concluded that there is a low maturity in the pharmaceutical sector regarding the protection and processing of personal data in view of the occurrence of conceptual confusion, the lack of transparency as to the form of treatment, excessive data collection, among other issues of lack of compliance. The Authority signaled the need to comply with the provisions of article 50 of the LGPD, which provides for rules of good governance practices that establish conditions of the organization; operating regime; procedures, including complaints and petitions from holders; safety standards; technical standards; specific obligations for the various parties involved; educational actions; risk mitigation mechanisms; and other aspects related to the processing of personal data.
This Technical Note presented other important considerations related to compliance in the processing of personal data in the pharmaceutical sector, such as the principle of necessity and the processing of biometric data, as well as the sharing of databases with third parties for the communication and marketing of delivery products and services. The document stressed the importance of analyzing, from the point of view of the principle of necessity, the processing of biometric data for the purpose of identity validation, considering that other data processing tools could also be employed, less burdensome in relation to the use of data as sensitive as digital or even facial biometrics.
With regard to the Drug Benefit Programs in Brazil, the ANPD recognizes that, initially, there may be damages to the right to information of the data subject regarding the price differentiation resulting from participation in loyalty programs and discounts, since the granting of the benefit conditions the prior sharing of the data of the holder to the final value of the discounted product, in disagreement with the principles of the LGPD and art.6, I, II and III, of the Consumer Protection Code.
The Authority also understood that the consent used in these situations, when applied as a legal basis, may not be exactly free and informed and that, therefore, in those cases, in which the conditioning of prices to the provision of consent in some processing of personal data by the sector was considered, the ANPD could benefit from joint work with the National Consumer Secretariat.
The Technical Note is the result of a study conducted by the General Coordination of Technology and Research (CGTP in Portuguese) that analyzed several privacy policies and websites of pharmaceutical groups with greater territorial coverage in terms of the number of customers, which suggested an apparent lack of adequacy and updating of pharmaceutical groups in relation to the LGPD and corporate adequacy regimes, in addition to the lack of transparency and the lack of operationalization of the right of access of the holder (art 9, LGPD).
The result of the study promoted the need for dialogues and technical meetings between CGTP and various industry associations to better understand the personal data operations carried out in pharmaceutical retail and suggest good practices and clarifications. The meetings were held with representative institutions such as Abrafad, ABCFarma, Abrafarma, and Febrafa.
Finally, the ANPD seeks an effective performance in the educational field to promote information, knowledge, and adoption of good practices in the protection of personal data, without neglecting its supervisory performance.
The General Coordination of Technology and Research of the ANPD forwarded the Technical Note for the assessment of the General Coordination of Supervision and the taking of any measures it deems appropriate, especially regarding the arts. 15, paragraphs 1, and 18, of Resolution CD/ANPD n. 1, of October 28, 2021. However, the ANPD clarifies that the monitoring of the sector and the preparation of an exploratory study does not represent a judgment of admissibility for the purposes of any inspection processes that may be conducted by the General Coordination of Supervision of this Authority.
The Technical Note can be checked in full, in Portuguese, at the link: https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-divulga-nota-tecnica-sobre-tratamento-de-dados-pessoais-no-setor-farmaceutico
