Technology—digital solutions as well as devices—has grown over the years to become a cornerstone of the business environment. It is no longer considered a luxury in the workplace, but a necessity, irrespective of whether the business is focused on technology. Businesses look increasingly to technology to help their workers be more productive and efficient, the discussion of privacy in the workplace, which is also related to cybersecurity, becomes relevant.

In Brazil, no laws or regulations apply specifically to workers’ privacy; this area is primarily regulated by the general provisions set out in the Brazilian General Data Protection Law (LGPD), although the LGPD provides no specifics on the processing of employee data. In addition to law provisions, there are some general adopted practices. These are based on labor case law, which shapes practices to protect workers from abuse in the workplace.

The LGPD, which is inspired to a great extent by the EU’s General Data Protection Regulation (GDPR), came into force on September 18, 2020 and created a new legal framework for the use of personal data in Brazil, both online and off, and in the public and private sectors.

The LGPD establishes a series of obligations related to the processing of personal data—from general ones, such as the need to rely on a legal basis to process personal data, to more specific ones on the processing of sensitive data. These include the data subject’s rights, the need to appoint a data protection officer, the specifics for international data transfers of data and the measures to be taken in the event of a data breach.

In general, any processing of personal data is subject to the LGPD, which also has extraterritorial application. A foreign company is subject to the LGPD if it:

• Has at least one branch in Brazil, or
• Offers services to the Brazilian market, or
• Processes the personal data of data subjects located in the country.

Processing employee data—legal bases

One of the first challenges faced by companies when dealing with workers’ privacy and workplace data protection involves identifying the legal basis to rely on when processing the personal data. The law provides for ten legal bases, and at first glance consent may seem the most appropriate for this purpose. But consent requires a free and unambiguous manifestation of will and, in practice, employers and employees typically do not negotiate under equal conditions; thus, if employee consent is used as the basis for the processing of their data may, it may be questioned by the Brazilian National Data Protection Authority (ANPD).

In general, when processing workers’ data the reasons (i) for compliance with a legal or regulatory obligation by the controller, (ii) when necessary for the execution of a contract, or (iii) for the legitimate interest of the controller are more appropriate legal bases to rely on.

In addition, it is important to highlight that, under Brazilian law, employers assume the risks of the economic activity performed and have the so-called power of direction, under which they are obliged to supervise employees’ activities, ensure the proper use of work tools, require compliance with company rules and impose disciplinary sanctions in case of a breach.

In view of this prerogative, currently case law has already established that employers have the right to access and review information generated by their employees on corporate devices, provided the employees have full prior knowledge that such devices are being monitored and should be used as work tools. Therefore, there is no expectation of privacy in such use.

In short, workers should assume that their employer is monitoring their activities, in particular in order to protect employer liability before third parties for the acts of its employees in the performance of their work, or by reason of it.

In the other hand, note that employers are not allowed to access the personal accounts of employees, such as email or messaging applications, even if the employee uses those tools on the employer’s equipment.

In general, companies must establish information security mechanisms, with a focus on privacy, aimed not just at other companies or customers with whom they interact, but also at the employees and collaborators who work in the company.

Digital tools and employee privacy

Regarding compliance with the rules and regulations on privacy and protection of personal data, employers may face challenges when implementing new technological tools and devices that bring improvements to their employee’s work or that make company operations more productive.

While monitoring in workplaces is generally allowed—so long as the provisions of the LGPD are observed—especially where sensitive information involved, a reasonable level of care is required. Personal data must be processed lawfully, with transparency and in a less intrusive manner, on a need-to-know basis. The employer must adopt security measures to protect data and avoid unauthorized access or disclosure.

Since the entry into force of the LGPD, the ANPD has made efforts to regulate the protection of personal data in the national territory. This includes, in addition to normative texts, the publishing of explanatory documents and guidelines.

This regulatory and supervisory stance of the ANPD is relevant insofar as, in 2022, through the Proposal for Constitutional Amendment No. 17/2019, the protection of personal data was included in the Brazilian Federal Constitution as a fundamental right.

Technology and privacy issues will always be part of the work environment, given the inherent need for technological interaction between the company and its employees and the fact that personal data is currently essential in the performance of various activities. A company keeps records of employees’ personal data as early as from the establishment of their business activity, and this may have occurred prior to the entry into force of the LGPD. Nevertheless, from the effective date of the LGPD, this must be done in accordance with the precepts of the law.

Therefore, as with any other personal data processing agent, as explained above, employers are obliged to process the personal data of their employees only to the extent necessary for the fulfillment of their legal obligations as an employer and in order to guarantee data subjects all the rights provided for in the LGPD, as well as to implement security mechanisms that are effective enough so that such data does not become a target of attacks or illegal access by third parties.

Finally, it worth mentioning that at the end of 2022 the ANPD published the regulatory agenda for 2023–2024, listing the topics that will be subject to regulation. Among those, it expects that there will be a regulation of the legal obligations of small-scale processing agents and a regulation and guidance materials on artificial intelligence, both of which will likely have a direct impact on privacy in the workplace.

The recent actions of the ANPD have shown its intention to regulate the protection of personal data to meet the social demands that have arisen, including demands related to privacy in work environments, as a way of guaranteeing the maintenance of individual rights and their compliance with the Federal Constitution/88, in addition to bringing Brazil closer to other countries that already have robust and delimited regulations on the protection of personal data and that consider the data subject with its due relevance.