Desvendando a governança de dados na Defensoria Pública do Estado do Rio de Janeiro: entre desafios e perspectivas para adequação à LGPD

Abstract

Data protection is a recent issue, which has become a global trend following its regulation by the European Union. Driven by this regulation, several countries, including Brazil, have started to legislate on the matter. However, data protection faces a number of difficulties in contemporary society, due to the speed, volume and variety with which data is produced, as well as the strategic role it has taken on for organizations. As a way of balancing this, data governance has become concerned with the privacy and security of data, in order to manage it with ethical, legal and regulatory compliance. In this sense, considering the nature and volume of data processed by the DPRJ and its level of maturity in adapting to the LGPD when compared to other agencies in the State of Rio de Janeiro, the study sought to analyze the development of data governance at the DPRJ in the context of the application of the LGPD. To this end, the research used a qualitative, descriptive and explanatory approach, adopting the DPRJ's single instrumental case study as its strategy. Data was collected through document analysis and semi-structured interviews with civil servants who are members of the CGPD and the Innovation Laboratory. The data was analyzed using content analysis and mixed categories (a priori and a posteriori). The results of the research point to the relevance of data as a strategic asset for the DPRJ and reveal that the organization has made progress towards building a data protection culture by adopting a series of measures which, in addition to bringing benefits to the DPRJ, seek to overcome the challenges it faces. These results, together with the theory, have made it possible to identify the eight pillars of a personal data protection and governance framework: fundamental principles; governance structure and responsibilities; policies, rules and processes; training and awareness; data lifecycle management with a focus on privacy; risk and incident management; transparency and the rights of personal data subjects; and monitoring and auditing. It is hoped that the proposed framework will provide a basis for further study of the topic in future studies and serve as a support for not only the Rio de Janeiro State Public Administration, but also other public sector organizations, to structure their privacy governance programs according to their particularities