Brazilian data protection law could boost health data market

In Brazil, whenever visiting a pharmacy or drugstore, you will be quickly preyed upon by a shop attendant and taken to one side. First, they will hand you a small basket for your purchases, and then request your taxpayer ID, with the promise of a store discount for those who are “signed up” to that particular pharmacy chain. Registering your tax ID at these establishments does not cost money and comes with some small discounts—3 for 2 on suncream, anyone?—but consumers should be asking themselves: where does their data go?

As of August 2020, the data of all Brazilians will be protected by a specific legislation: the General Law of Data Protection (LGPD), sanctioned this year. As a result, the companies that collect and store this information will have numerous obligations regarding this material, whether it be online or offline.

The collection, handling, storage and sharing of this material must be done according to the classifications given by the LGPD. For example, any and all data that contains personal information is considered sensitive. This means that the handling of this content must be done carefully by companies, with the establishment of barriers in order to avoid the possibility of finding out who is the “owner” of said information. 

One example of sensitive data is information related to health. Lawyer Lucas Paglia, a data protection expert, explains that this information has been classified as such because of the effects that any disclosure or leak could have. According to Mr. Paglia, details about patients’ medical history can affect their professional life or even make it difficult to obtain certain health services.

Even with the protections in place, the LGPD regulates the possibility of sharing and selling this information...