Use of generic consent as a business and data governance risk

Abstract

This article aims to analyze the complexities and risks of business activity that justify its personal data processing operations based on the legal basis of consent, as stipulated in Article 7, item I, of the Brazilian General Data Protection Law (LGPD). To this end, a parallel will be drawn between the historical context of regulations related to privacy and data protection, and the general concepts of the LGPD, particularly the legal basis of consent, to arrive at the central point of this study. This is done considering the importance of understanding the role of consent in the evolution of data protection laws and, especially, how the LGPD addresses this legal concept. Thus, as a methodology, scientific knowledge, a deductive approach method, and a bibliographic procedure method are utilized. Finally, the article seeks to understand when to use consent as a legal basis for data processing, ultimately concluding that the generic use of this legal basis, without mapping the data flow of the business activity, leads the entrepreneur to assume risks that could subject the business activity to administrative or judicial sanctions, severely impacting the entire business.