A EFETIVIDADE DA ANONIMIZAÇÃO NA LGPD

UM ESTUDO SOBRE REVERSIBILIDADE, RAZOABILIDADE E O PARADIGMA DA ENTROPIA DE DADOS

Abstract

The Effectiveness of Anonymization in the LGPD: A Study on Reversibility, Reasonableness, and the Data Entropy Paradigm

The ubiquity of digitalization in contemporary relationships has accentuated the centrality of personal data, making it a fundamental input for various activities and conferring an imperative character to its protection. The Brazilian General Data Protection Law (LGPD – Law No. 13,709/2018), by establishing a protective legal framework, conveys the distinction between personal and anonymized data, with the latter, in principle, being excluded from the scope of the norm. However, the rapid evolution of technologies and the increasing capacity for information processing give rise to a persistent questioning about the effectiveness of anonymization as a definitive measure of de-identification, generating notable legal uncertainty and interpretative dilemmas, especially regarding reversibility criteria.   The research problem lies in the imprecision of the parameters that qualify the reversibility of an anonymization process and the measurement of "reasonable means" for identification, as provided in the LGPD. This normative ambiguity imposes challenges to the application of the law and the guarantee of data subjects' rights, given that pseudonymized data – i.e., data that, although masked, can be linked to an individual through supplementary information – are intrinsically considered personal data, and even encrypted data, prima facie, fall under pseudonymized data. The central hypothesis is that incorporating the concept of data entropy, derived from computer science, can provide greater objectivity and predictability to the evaluation of the degree of irreversibility of anonymization, qualifying the criterion of reasonableness and, thus, strengthening legal certainty and data protection in practice.   The objectives of this study are: (i) to analyze the conceptualization and distinction between personal, pseudonymized, and anonymized data in light of the LGPD and doctrinal discussions; (ii) to investigate the risks and techniques of data re-identification, such as "quasi-identifiers" and the "growth problem," which challenge the robustness of anonymization; (iii) to explore the concept of data entropy as a technical-legal criterion complementary to "reasonableness" for determining the irreversibility of anonymization; and (iv) to propose, based on this analysis, subsidies for the construction of regulatory guidelines that ensure greater transparency and effectiveness in the management of anonymized data.   The investigation will be developed using a deductive method, starting from the normative framework of the LGPD and the general theory of data protection to delve into the technological analysis of anonymization and re-identification processes. The methodology will consist of an exhaustive bibliographic-doctrinal research, covering national and international legal literature, as well as technical studies in cryptography, information security, and computer science, to allow for an interdisciplinary understanding of the subject matter and the construction of a theoretical framework that supports the proposition of entropy as a guiding element.   Keywords: Anonymization; LGPD; Reversibility; Reasonableness; Data entropy.   References (Examples to be included at the end of the article, according to ABNT 6023:2018):   FALEIROS JÚNIOR, José Luiz de Moura; MARTINS, Guilherme Magalhães. Proteção de dados e anonimização: perspectivas à luz da Lei nº 13.709/2018. Revista Estudos Institucionais, v. 7, n. 1, p. 376-397, jan./apr. 2021.   MACHADO, Diego; DONEDA, Danilo. Proteção de dados pessoais e criptografia: tecnologias criptográficas entre anonimização e pseudonimização de dados. Revista dos Tribunais, vol. 998. Caderno Especial. p. 99-128. São Paulo: Ed. RT, December 2018.