The Brazilian Mediation Act (Law 13140/2015) establishes that “the object of mediation may be a dispute over “disposable” (transferable or waivable) rights or non-disposable, non-waivable rights which are able to be negotiated” (art. 3).
In this sense, we wonder if mediation will be available to all the new conflicts that will emerge from the new Data Protection Act in Brazil.
The brazilian General Data Protection Act (Law n. 13/709/2018 or LGPD) establishes the data subject as a natural person to whom the personal data that are the object of processing refer to.
The LGPD demands the consent of the data subject in almost any case of data processing. But even after the consent to the processing of their personal data, the natural person remains the data holder, having the right to access and manage its use. The ownership of personal data is connected to the fundamental right of privacy.
Article 18 enlists some rights that provide to the data subject the management of their own data:
I – confirmation of the existence of the processing;
II – access to the data;
III – correction of incomplete, inaccurate or out-of-date data;
IV – anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance with the provisions of this Law;
V – portability of the data to another service or product provider, by means of an express request and subject to commercial and industrial secrecy, pursuant to the regulation of the controlling agency;
VI – deletion of personal data processed with the consent of the data subject, except in the situations provided in Art. 16 of this Law;
VII – information about public and private entities with which the controller has shared data;
VIII – information about the possibility of denying consent and the consequences of such denial;
IX – revocation of consent.
Besides, in article 20, LGPD establishes that the data subject has the right to request review of decisions taken solely on the bases of automated processing of personal data that affects her/his interests, including decisions intended to define her/his personal, professional, consumer or credit profile or aspects of her/his personality.
All those rights are tools for the data subject to manage their own personal data. We understand that conflicts involving those rights might be the object of mediation, since they do not interfere with the fundamental right to privacy. For instance, one might discuss in which conditions the data processing will occur, or how the large amount of information will be provided. There are many possibilities for the work of negotiation and mediation in all of those scenarios.
From our point of view, one must take special care with the nature of the data subject as the owner of their own personal data, since it is very much connected to the fundamental right of privacy, therefore non-disposable and non-waivable. If the negotiation goes too deep into this field, it might be the case to seek confirmation by a court (art. 3. paragraph 2 of the Mediation Act).
________________________
To make sure you do not miss out on regular updates from the Kluwer Mediation Blog, please subscribe here.
This will be an interesting subject in the medium term future. A question about having to seek approval from the courts in Brazil in order to undertake a mediation, is the fact that Brazilian courts are already so backlogged with thousands of cases – even before the onset of COVID-19. This process could really slow down mediation of these data protection cases considerably, taking away a major advantage of mediation which is speed and flexibility.