Data protection: “Cancellation” of the data after the end of its processing

Many services offered across the Internet are free. Social networks, search engines or other applications are viable through the sale of advertising space. Online advertising gains value when the one selling the advertising space promises to display it to selected and specific audiences. It is through the collection of personal data that companies know more about users’ profiles and can customize ads for them, increasing its advertising revenue. Thus, we are constantly trading our personal data for products and services.

Although this finding may generate some discomfort, it’s not uncommon to find consumers who would rather consent to the use of their data in exchange for services than actually paying for them in cash. It does not mean that these consumers accept giving up total control of the data, which, by the way, never cease to be owned by them. More and more consumers are concerned about what will happen to their data after consent was given for the collection.

This new concern is reflected in the discussion on the limits to the activity of the ones responsible for the processing of personal data. After all, data is not merely a bargaining chip on the Internet, it is also part of the personality of individuals and as such must be protected. Data may be sensitive or easily used to unfairly discriminate individuals, for example.

Article 15 of the Data Protection Draft Bill establishes one of the many limitations that the bill seeks to impose to the processing of such data. According to this article, the data will be canceled after the end of the processing, i.e. data should be deleted after the end of all the uses to which the consumer has consented.

This article, however, enumerates in its items three exceptions to the general rule, in other words, three cases in which data retention will be allowed even after the end of the processing for which the consumer consented. In particular, item III has caused controversy in the public consultation:

Art. 15. Personal data will be canceled after the end of its processing, allowed the retention for the following purposes:

III – transfer to third parties, under this Law.

The concern of participants in the public debate is because, apparently, the item makes it possible for companies holding the consumer’s initial consent to market data without the specific permission of the owners for that.

The debate on the platform, it seems, revolves around the meaning of “under this Law” contained in the item. What guarantees and possibilities to control their data would the consumer have in this case? The participant Flavio Costa gave his suggestion:

“This transfer should necessarily have to receive a new authorization of users, especially if the purpose, suitability and other principles become different by the transferee.”

The opinion of Flavio Costa, although it seems a natural solution to the problem, can find series of oppositions. This is because, depending on the number of transfers to which the data is submitted, the renewal of the authorization for the processing throughout the transfer will not be practical for consumers and even less for companies.