Application of the personal data protection law in Brazil: a case study of some data-driven businesses

• Pages: 26-68
• Author: Vivian Newman-Pont,Daniel Ospina-Celis,Juan Carlos Upegui

26 Data Feast: Enterprises and Personal Data in Latin America

APPLICATION OF THE PERSONAL DATA

PROTECTION LAW IN BRAZIL: A CASE STUDY

OF SOME DATA-DRIVEN BUSINESSES

Kimberly Anastácio

Bruna Martins dos Santos

Joana Varon

is research was conducted by Coding Rights in partnership with Centro

deEstudios de Derecho, Justicia y Sociedad (Dejusticia). Dejusticia co-

ordinated a comparative research between Colombia, Chile, Mexico,

and Brazil on the implementation of their personal data protection laws.

Coding Rights analyzed the privacy policies and terms of service of on-

line service applications oering services in Brazil to nd out how they

conform to the provisions of the Brazilian data protection law. Following

the comparative analysis methodology dened for the study, four compa-

nies with data-driven business models (CDDBM) were selected. Hence,

Amazon Prime Video was selected for the large Internet companies group;

iFood was selected for the intermediate companies group; Social Miner

was selected for the start-ups group; and Magazine Luiza was selected for

the established companies group.

is article is divided into four sections. Section 1 describes the selec-

tion criteria for the companies analyzed and identies four main aspects of

their terms of service and privacy policies: 1) source of the data collected,

2) data processing, 3) purpose of processing, and 4) the relationship of the

companies and the data collected with GAFAM companies. Section2 ana-

lyzes how the practices of these companies conform to the Brazilian data

protection legal regime. e practices of the companies selected are ob-

served to outline the points that may be compared with the provisions of

BACK TO TOC

27

Working Paper 10

the Personal Data Protection Law (LGPD) and other regulations regard-

ing the protection of privacy and personal data, like the Consumer Defense

Code, the Civil Rights Framework for the Internet, and the Constitution of

Brazil. Section3 evaluates whether the work of the National Data Protec-

tion Authority (ANDP), the entity in charge of monitoring the application

of the Brazilian law, adequately addresses the practices of the companies

mentioned above, mainly regarding the former’s regulation, supervision,

control, and sanctioning capacity. Finally, conclusions and recommenda-

tions are presented so that the operations of the CDDBMs are increas-

ingly in line with the country’s data protection principles and regulations,

especially considering the need for companies to conform to the recently

enacted law (LGPD), to become eective in 2020.

1. Selection of CDDBMs

1.1. GAFAM Company: Amazon Prime Video

is study analyzes both Amazon Prime Video’s video-on-demand ser-

vice and the specicities of its oer linked to Vivo, Brazilian telephone

concessionaire and subsidiary of Telefónica. Amazon Prime launched in

Brazil in September 2019, when this study was already underway. Before,

since 2018, the telephone operator Vivo, began oering the video stream-

ing service Amazon Prime Video to its customers, in partnership with

Amazon. erefore, in this study, we analyze the documents and policies

in force before September 2019, when the service was oered jointly with

Vivo. In this case, the company oers a 90-day-free trial; then, charges

7.90 reals during the rst 6 months and, from the next month, 14.90 reals

per month.12 However, to subscribe, one must be a mobile or broadband

customer of Vivo. Amazon also oers the plan directly in Brazil, but only

oers a 7-day free trial; then the service also costs 7.90 reals per month for

the rst six months, and then increases to 14.90 reals per month.13

Besides the fact that this partnership with Vivo is considered in-

teresting in terms of data protection, it is also important to analyze

Amazon Prime Video in terms of Amazon’s dispute with Google regard-

ing the service. Aer several months of retaliation, both giants reached an

12. Current costs as of the date of access available on Vivo’s website: https://

www.vivoparasuacasa.com.br/amazonprimevideo/?gclid=EAIaIQobChMIl

ba8weX_4wIVlIaRCh3epwrjEAAYASAAEgKRIvD_BwE

13. Costs available as of the date of access on Amazon Prime Video’s website:

https://www.primevideo.com/

BACK TO TOC

28 Data Feast: Enterprises and Personal Data in Latin America

agreement, and the service became available for Chromecast in June 2019

(Gartenberg2019).

1.2. Intermediate Company: iFood

iFood is a closed capital company founded in 2011 and currently oper-

ates in over 200 cities14 in Brazil and in Mexico, Colombia, and Argentina.

iFood is a food delivery platform. e service, oered on a web version

and in applications for iOS, Android, and Windows Phone, serves almost

600,000 orders a day in Brazil to its 12million active users (Daroit2019).

e company also has a product called iFoodLabs, an innovation labo-

ratory focused on applying a business vision to ideas that combine food

and technology. Using market data, experiences, clients’ use cases, and

interviews with stakeholders and specialists, the laboratory designs meth-

odologies to create solutions for the delivery segment of the food sup-

ply chain. e laboratory created products such as the SpoonRocket15

and iFoodNext, a division focused on developing soware and services

focused on the demands of restaurant owners. e company also has a

platform called iFood Shop (Belloni2018), which connects restaurants

with packaging and supplies providers.

e start-up has received contributions by companies such as Móvile,

which invested 5.5million reals in 2013 (Zuini2013) and 125million re-

als (together with the British company Just Eat) in 2015. In November

2018, Móvile announced that iFood would receive an investment of

500million dollars (Brigao2018), equal to 1.9trillion reals—the larg-

est investment by a private technology company in Brazil. e idea of the

investment was to extend iFood’s operations in the country and double

the number of restaurants (currently about 66,000) and the cities served

(500 municipalities; Freitas2019b). iFood is the 23rd most downloaded

app on the Play Store. e application has over 10million downloads and

is the most downloaded app in the “Food & Drink” category on the Play

Store.

1.3. Start-up: Social Miner

e company is on several “start-ups to watch” lists in the country for

drawing the aention of start-ups acceleration programs led by companies

14. iFood “Cidades Atendidas” (no date). Retrieved August 15, 2019. from

https://www.iFood.com.br/cidades-atendidas.

15. Available at the application’s website: https://www.spoonrocket.com.br/