Search
Close this search box.
Categories
Data Protection

Data Leaks in Brazil: Alert for Companies and Customers

Imagine you discover a loan of almost R$94,000.00 in your name, without ever having applied for it. Reason: growth of data leakage in Brazil.

This is what happened to Camilla Gomes, who shared her story on
LinkedIn News.
A project analyst who, after receiving a message from a supposed flower shop, fell for a sophisticated scam.

Camilla went through a fake facial recognition check and, unknowingly, had her photo used to authorize the opening of a line of credit.

This is just one example of how data leaks in Brazil affect the lives of many people, leaving them vulnerable to scams and fraud.

Brazil faces a growing crisis of improper disclosures of personal and business records, ranking 12th among countries with the most data leaks in 2022.

Despite the implementation of the General Data Protection Law (LGPD), cases of information theft and leakage continue to increase.

In this article, we will analyze the reasons why Brazil is one of the main targets for cybercriminals and how the CipherTrust solution can help in data protection and privacy.

Data Leaks: The Roots of the Problem

Information leaks in Brazil have several causes, and to understand them, it is fundamental to analyze the country’s digitalization history and the relationship between the public and private sectors in the defense of personal information.

  • Accelerated digitization and infrastructure failures

The digitalization process in Brazil occurred quickly, but not always with the necessary infrastructure to adequately protect personal records.

The pressure to keep up with global trends and the growing demand for digital services has led to an accelerated implementation of computerized systems, often leaving crucial security aspects aside.

  • Vulnerabilities in the public sector

Most of the data leaked in Brazil comes from public agencies, where technological updating processes are slow, and the lack of investments aggravates the situation.

In addition, the implementation of transparency systems without adequate criteria contributes to the exposure of sensitive information, making it easier for cyber criminals to access this information.

  • Design Issues in the Private Sector

In the private sector, design flaws in information systems also contribute to the vulnerability of records. An example of this is the use of personal identification numbers, such as CPF and RG, as keys to access information and financial operations.

This practice increases the value of this data to criminals and amplifies the exposure of personal information, making it easy targets for scams and fraud.

  • Insufficient privacy and data security culture

The lack of a culture of privacy and information security in Brazil is another factor contributing to the vulnerability of information.

Companies and government agencies do not always have clear and effective policies to protect the details of their customers and users, resulting in a failure to protect this information.

LGPD implementation challenges and insufficient ANPD contribute to data leaks

Although the creation of the LGPD and the ANPD (National Agency for Data Protection) represents an advance in the scenario of information defense in Brazil, the effective application of these regulations still faces challenges.

The lack of human and financial resources available to the ANPD, as well as the difficulty of adapting organizations to the new legislation, limits the scope of actions to combat data leakage and fraud.

These factors combined create an enabling environment for cybercriminals, who take advantage of weaknesses in data safeguarding in Brazil to carry out attacks for financial gain.

To face this scenario, it is essential to invest in efficient solutions, such as the CipherTrust platform, and promote a cultural change that values privacy and the defense of personal records.

CipherTrust: Enhanced data protection and privacy for enterprises

Companies in all industries face increasing challenges in ensuring data security and privacy in an increasingly complex threat landscape.

The CipherTrust Data Security Platform solution is an integrated set of solutions that unify the discovery, protection and control of records in a single, comprehensive platform, addressing the challenge of enterprises regarding information defense and privacy.

Main benefits of the CipherTrust solution in preventing data leakage

  • Simplifying Data Security

The CipherTrust platform enables organizations to discover, protect and control their most sensitive records on-premises and in the cloud in a simplified way.

With an integrated and unified approach, companies can effectively manage protection and minimize the risks of data leaks and breaches.

  • Accelerated time to compliance

The CipherTrust solution offers comprehensive information security features such as data discovery and classification, encryption, granular access controls, audit logs, tokenization, and key management.

These features help companies comply with information security and privacy requirements, making the process of compliance with regulations such as LGPD faster and more efficient.

  • Promoting Safe Migration to the Cloud

CipherTrust Data Security Platform enables enterprises to confidently migrate their workloads to cloud and on-premises environments, ensuring continuous protection and control of their data.

In addition, the solution makes it easy to repatriate records back to the site when necessary, maintaining the integrity of the information at all times.

By adopting the CipherTrust platform, Brazilian companies can more effectively face the challenges of cybersecurity, ensuring the defense and privacy of their clients’ data.

This comprehensive, integrated solution enables organizations to minimize risk and adapt to the increasing demands of a constantly evolving digital environment while securing customer information and trust.

The urgency to combat data leaks in the current scenario

With the growing number of data leaks and the complexity of cyber threats in Brazil and worldwide, ensuring security, protection, and privacy has become an absolute priority for companies in all sectors.

Adopting robust and comprehensive solutions, such as the CipherTrust Data Security Platform, is essential to effectively address the challenges and risks inherent in today’s digital environment.

It is always worth remembering

It is vital to remember that compliance with laws such as LGPD should not be seen as a legal obligation, but an opportunity for companies to improve security practices, building trust and loyalty with customers and partners.

Data protection and privacy are no longer optional issues, but strategic imperatives that directly impact the reputation, business continuity, and success of companies in the global marketplace.

The adoption of solutions such as CipherTrust Data Security Platform represents an essential investment to ensure the resilience and prosperity of organizations in an increasingly connected and digitalized world.

About Eval

With a track record of leadership and innovation dating back to 2004, Eval not only keeps up with technological trends, but we are also in an incessant quest to bring news by offering solutions and services that make a difference to people’s lives.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Written by Arnaldo Miranda, Evaldo. Ai, reviewed by Marcelo Tiziano and designed by Caio.

Categories
Data Protection

ANPD and LGPD: The Importance of Law 13.853

On July 8, 2019, Law No. 13,853 was published in the Federal Official Gazette (DOU) with the purpose of formalizing the creation of the National Data Protection Authority (ANPD).

Basically, the ANPD as a national authority and public administration body is responsible for ensuring, implementing and enforcing compliance with the General Data Protection Law (LGPD) throughout the national territory.

According to the LGPD, the National Data Protection Authority is composed of:

  1. Board of Directors
  2. National Council for the Protection of Personal Data and Privacy
  3. Internal Affairs
  4. Ombudsman
  5. Own legal advisory body
  6. Administrative units and specialized units necessary for the implementation of the LGPD

In addition, the Board of Directors of the ANPD shall be composed of five (5) directors, including the Chief Executive Officer.

But law 13.853 did not consist only in the creation of the ANPD, it went further and established important changes for companies that need to adapt to the requirements of the General Data Protection Law.

The approved modifications were fundamental for the applicability of the LGPD. Since without the creation of the ANPD, the law risked becoming practically unworkable, contradicting a system that has demonstrated worldwide effectiveness.

LGPD requirements: law 13.853 went beyond the creation of the National Data Protection Authority – ANPD

The General Data Protection Law provides, among several competences, that the ANPD must ensure the protection of personal data and develop guidelines for the National Policy for the Protection of Personal Data and Privacy.

Therefore, the National Data Protection Authority has a great responsibility regarding the supervision of the requirements defined by the LGPD and that must be met by companies that must adapt to the new legislation that comes into force in 2021.

In addition to consolidating the creation of the ANPD, Law 13.853 was responsible for solidifying important changes provided for by data protection and privacy legislation:

  • The law provides that data protection is of national interest, avoiding the proliferation of state and municipal laws that attempt to regulate the matter;
  • The data controller may be a legal person, and its appointment will also involve the data operator. In the original version, this assignment was exclusive to the data controller;
  • With the changes, the law excludes the obligation to inform the data subject in cases of processing of personal data to comply with a legal or regulatory obligation or when carried out by the public administration, for the execution of public policies provided for in rules or contracts;
  • It expands the hypotheses of communication and shared use of sensitive data related to health, explaining the scope to those related to pharmaceutical care and auxiliary services of diagnosis and therapy. In addition, also in cases of portability requested by the holder, or for financial and administrative transactions resulting from the use and provision of said services;
  • Health insurance companies are prohibited from using health data for risk selection, or for the purpose of hiring or excluding beneficiaries;
  • It inserts the possibility to waive the communication by the controller to the data controller. This, in the case of sharing data that has undergone correction, deletion, anonymization or blocking of data, where such communication proves impossible or represents a disproportionate effort
  • It establishes conditions for cases of sharing personal data, contained in databases in government agencies, to private entities;
  • It brings the hypothesis of direct conciliation between the data controller and the data subject – in cases of individual leaks or unauthorized access -, prior to the application of legal sanctions;
  • Establishes the need for the members of the ANPD Board of Directors, chosen by the President of the Republic, to be approved by the Federal Senate;
  • It defines rules for the composition of the ANPD, its attributions and the origin of its revenues;

The ANPD has several roles and responsibilities, including investigating organizations that have suffered data breaches, imposing penalties where appropriate, and generally auditing companies for their data collection and storage practices.

Accelerating compliance with the GDPR

How does ANPD support the General Data Protection Law and businesses?

As the national authority responsible for overseeing and applying sanctions in case of non-compliance with data protection and privacy legislation, the National Data Protection Authority also aims to promote good practices in the processing of personal data and guidance on data protection.

In practice, the publication of law 13.853, creating the ANPD, consolidates the legal bases for processing, data auditing and privacy policies, aiming to ensure that the personal data of customers and employees are processed legally.

The importance of the ANPD for business

The publication of Law 13.853 was fundamental for companies that already face several challenges in their routine search for information security in their business processes.

There are often time constraints, budget and more pressing operational concerns that may take higher priority over cybersecurity.

But there are other issues as well, with the lack of knowledge in data protection and privacy that directly impact the difficult journey of meeting the requirements provided by the LGPD.

Therefore, the National Data Protection Authority should help companies understand their data protection responsibilities by providing resources, support and guidance, tailored to the needs of organizations according to their segment, size and applicability of data protection law.

In addition, the ANPD should also promote awareness among the population of public rules and policies on personal data protection and security measures, prepare studies on national and international practices on personal data protection and privacy, and encourage the adoption of standards for services and products that facilitate control over their personal data, which should take into account the specificities of the activities and the size of those responsible.

Indeed, technology is driving changes in the social, political, legal and commercial environment that the National Data Protection Authority needs to regulate.

The most significant data protection risks for individuals are now driven by the use of new technologies and so the role of the ANPD will be key throughout this process.

With just over a year to go, companies need to be aware of the next steps of the LGPD. That is, the implementation of the necessary compliance actions in accordance with the law.

About Eval

Eval has been developing projects in the financial, health, education, and industry segments for over 18 years. Since 2004, we have offered solutions for Authentication, Electronic and Digital Signature, and Data Protection. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With market recognized value, Eval’s solutions and services meet the highest regulatory standards for public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.