Since the sanction of the LGPD in August 2018, through the approval of Provisional Measure No. 869/2018, until the conversion of the MP into law (Law No. 13.853/2019), the Data Protection Officer (DPO) role has gone through some twists and turns, such as the possibility of the DPO being an individual or legal entity, and the requirement of having regulatory legal knowledge.

Therefore, this brief article aims to provide some clarification regarding this crucial role in the context of data protection. Job vacancies have indeed arisen, but along with them, the responsibility and demands of the market!

In the definition of Article 5, item VIII, of the LGPD, the DPO is the "person appointed by the controller and operator to act as a channel of communication between the controller, data subjects, and the National Data Protection Authority (ANPD)."

Drawing an analogy from the world of soccer, we can think of the DPO as the "midfielder" of the team, responsible for connecting the defense and the attack. Visually, we have:

Thus, the DPO is the figure responsible for mediating the dialogue between the controller and the data subject or between the controller and the ANPD, accommodating their needs and interests.

Among their various responsibilities, all outlined in Article 41, § 2 of the LGPD, the DPO's activities consist of:

_I - accepting complaints and communications from data subjects, providing explanations, and taking action;

II - receiving communications from the national authority and taking action;

III - guiding employees and contractors of the entity regarding practices to be taken regarding the protection of personal data; and

IV - performing other duties determined by the controller or established in complementary regulations._

To fulfill these responsibilities, the DPO must master data mapping techniques, identifying all possible sources of collection, as well as controlling the data's lifecycle, i.e., how it will be stored and used, with whom it will be shared, when and how it will be deleted.

Another fundamental aspect for the DPO to truly fulfill the role that the LGPD proposes is autonomy in decision-making power and the exercise of oversight of internal company processes. Naturally, as a professional hired by a particular company to act according to its interests, the DPO will have a degree of subjection to the guidelines of their employer. However, this should not compromise their position as an intermediary between the data subject and the ANPD.

In conclusion, it is worth considering that although the current wording of the LGPD no longer requires the DPO to have regulatory legal knowledge, knowledge and, above all, mastery of the LGPD and other applicable regulations in the context of personal data protection are essential for the effective performance of the DPO's functions. This is especially true because the LGPD should not be analyzed in isolation but always within the context of the market and the company's regulations seeking compliance.

Nevertheless, the growing concern of entrepreneurs regarding the LGPD is natural. After all, Brazil is an extremely complex country for entrepreneurship, and every new regulation brings uncertainty and instability to the game.

ABOUT THE AUTHOR:

Dânton Zanetti is a lawyer, founding partner of Zanetti, Oliveira & Machado Sociedade de Advogados (www.zomadv.com), working in the areas of Business Law, Contract Law, and Digital Law, with a Master's in privacy and data protection.