A regulação das tecnologias de perfilamento no direito brasileiro: articulando direito e tecnologia para a promoção da proteção de dados desde a concepção

Abstract

This Ph.D. dissertation aims to analyze the legal regulation of profiling technologies under the Brazilian law, and to propose the articulation between these technologies and the right to the protection of personal data, according to the legal protection by design perspective. It is a legal-theoretical investigation that adopts the methodological procedure of content analysis. The work has three chapters. The first chapter consists of outlining a theory that comprises the protection of personal data as a legal concept and a fundamental right distinct and autonomous from the idea of privacy and its legal protection. It is a theoretical conception in line with Mireille Hildebrandt’s perspective of legal protection by design. It also explains the origins of the collective dimension of both rights to privacy and to data protection. Chapter 2, in turn, addresses the elements and technical notions that underpin the use of profiling technologies, especially the automated profiling process’ steps, namely the construction and the application of personalized profiles and group profiles. By studying algorithmic systems powered by automated profiling, one can understand why they are characterized as invisible and opaque. In fact, such aspects are somehow reflected in the reasons that justify the need to regulate profiling technologies: the integration into the information and communication infrastructure of preemptive computing, and the threats and risks posed to fundamental rights and freedoms. The chapter also deals with the regulation of such technologies under the Brazilian law, notably through the legal provisions of the LGPD, CDC, LCP, and MCI. Finally, chapter 3 reviews the features of the regulation of profiling technologies that are previously examined. It was found that the invisibility and opacity of automated profiling practices gave rise to the incontestability of these technologies, while their legislative discipline proved to have (apparent) gaps and to lack uniformity, in addition to being elaborated from a predominantly individual-centered point of view. From this point, a reading of the profiling technologies regulation is developed in accordance with the systematic unity of the Brazilian legal system and with the collective dimension of the fundamental right to the protection of personal data. Furthermore, there is also an articulation of the legal normativity of this fundamental right with the promotion of the contestability of automated profiling systems. Three interpretative proposals are made: (i) the expansion of the concept of personal data; (ii) the affirmation of the collective dimension of the protection of personal data and the consequent legal protection of collective interests within the scope of automated profiling processes; and (iii) a regulatory framework based on the principle of data protection by design for the construction of contestable profiling systems. It is concluded that the fundamental right to the protection of personal data, with autonomous nature regarding the right to privacy, and its infra-constitutional legislation as well are applicable to the entire automated profiling process, covering both personalized profiles and group profiles.