Open Data vs. Data Protection: A Necessary Balance

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The tension between opening public data and protecting personal information calls for a strategic compliance approach that balances transparency and privacy.

The Current Landscape: Open Data and Privacy on a Collision Course

We live in an era in which governments and public institutions are steadily expanding their open data initiatives, making entire databases available for citizen scrutiny, academic research, and the development of technology solutions. At the same time, the legal framework for personal data protection, consolidated in Brazil by the LGPD (Brazil’s General Data Protection Law), sets clear limits on how that information may be processed. A closer look at this landscape shows that the two paradigms do not coexist easily and call for technical and legal caution.

The open data policy provided for in the Access to Information Law (Law No. 12.527/2011) rests on the premise that transparency is a fundamental democratic value. Data on public spending, procurement, and health and education indicators must be accessible to any citizen. But when these databases contain information that directly or indirectly identifies natural persons, the LGPD comes into play. This is where the most complex challenges arise for organizations that conduct data due diligence.

Data due diligence is a structured process of verifying, mapping, and assessing the databases an organization uses, acquires, or shares. It has become strategically important in recent years, especially in corporate transactions (mergers and acquisitions), in hiring technology vendors, and in implementing projects that involve large volumes of data. Companies that neglect this step often expose themselves to significant regulatory risks, including administrative sanctions from the ANPD (Brazil’s National Data Protection Authority).

This topic is directly related to data anonymization, a subject we cover in a dedicated article.

This topic is directly related to public data sharing, a subject we cover in a dedicated article.

Legal Bases and the Processing of Public Data

A common mistake we see in practice is the belief that data published on transparency portals or open government databases can be processed freely, without any restriction. Article 7, item III, of the LGPD allows the public administration to process data in order to carry out public policies, but that legal basis does not automatically extend to private-sector entities that access the same databases. When a company collects data from public portals for commercial purposes, it must identify its own legal basis to justify the processing.

Article 7, paragraph 3, of the LGPD provides that personal data whose access is public must be processed in light of the purpose, good faith, and public interest that justified making it available. This means that even when data is technically accessible to anyone, the purpose principle imposes limits. If a public registry was created to enable administrative transparency, using it for direct marketing or commercial profiling may amount to a departure from its original purpose, which the law expressly prohibits.

Anonymized data, often presented as the solution to this impasse, also deserves a look. The LGPD defines anonymized data as data relating to a data subject who cannot be identified, taking into account the use of reasonable and available technical means at the time of processing. When open data portals publish information that is truly anonymized, the processing is not subject to the LGPD’s restrictions. However, re-identifying data subjects from supposedly anonymized databases is a real risk, especially when multiple data sources are cross-referenced. Studies in data science show that combining just a few seemingly harmless attributes can be enough to identify individuals in large population databases.

Data Due Diligence in Practice: Methodology and Critical Points

When we conduct due diligence processes involving open data, we follow a structured, step-by-step approach that lets us map risks accurately. The first phase is the data inventory, in which we catalog every database the organization uses, identifying its source, format, volume, purpose of use, and retention period. This step often reveals that organizations have kept public databases in storage for years, with no control over updates or compliance checks.

The second phase involves classifying the data by sensitivity level and verifying the legal bases that apply to each processing activity. At this point, we distinguish among truly anonymized data (outside the scope of the LGPD), public personal data (subject to the LGPD with the particularities of Article 7, paragraph 3), and sensitive personal data that may appear in open databases (subject to even stricter restrictions under Article 11 of the LGPD).

The third phase is the risk assessment itself, in which we consider the likelihood and impact of incidents such as leaks, misuse, re-identification of anonymized data, and failure to meet regulatory obligations. Organizations that work with large volumes of public data often underestimate the risk of re-identification, especially when they combine databases from different government sources.

The fact that data is public does not mean it can be processed freely: the original purpose for which it was made available is the yardstick for legitimate uses.

The Data Protection Impact Assessment (RIPD), provided for in the LGPD, is an essential tool in this context. Although the law does not require one for every processing activity, we strongly recommend preparing it when an organization cross-references public databases on a large scale, given the potential risks to data subjects.

Data Governance: Building Bridges Between Transparency and Privacy

The apparent contradiction between open data and data protection dissolves once we take an integrated governance perspective. The goal is not to choose between transparency and privacy, but to build mechanisms that make both possible at the same time. International experience offers some interesting models: the European Union’s General Data Protection Regulation (GDPR) coexists with the Open Data Directive (Directive 2019/1024), and member states have developed ways of reconciling the two that could inspire the Brazilian landscape.

Within an organization, open data governance requires clear internal policies that define how it collects, stores, processes, and shares data from public sources. These policies should cover anonymization and pseudonymization procedures, criteria for cross-referencing databases, disposal protocols, and incident response mechanisms. Organizations with mature governance programs can tap the potential of open data with legal certainty, while those without adequate structures build up hidden regulatory liabilities.

The role of the Data Protection Officer (DPO) takes on special importance in this context. This professional should take an active part in decisions about the use of open data, assessing the compliance of every new project or partnership that involves public databases. Close dialogue among the DPO, the technology teams, and the legal teams is essential for an organization to keep innovation and compliance in balance.

Another aspect that deserves attention is contracts. When organizations share or receive open data in commercial settings (for example, in contracts with data analytics startups or in public-private partnerships), the contracts should include specific clauses on purpose of use, a ban on re-identification, security obligations, and liability for incidents. Without these clauses, the parties involved in the processing may be held jointly and severally liable.

Trends and Challenges for the Future

Brazil’s regulatory landscape is constantly evolving. The ANPD has issued supplementary regulations detailing the obligations of processing agents, and case law on data protection grows every year. We are closely following the development of specific rules on artificial intelligence, which will directly affect how open data can be used to train algorithmic models.

Law No. 13.709/2018 (the LGPD) has now completed its first years of effective enforcement, and we are seeing greater maturity on the part of both regulators and organizations. The sanctions imposed by the ANPD, although still relatively few, signal an enforcement stance that is likely to intensify. Organizations that use open data in their operations should anticipate this shift and invest in preventive compliance.

The concept of “privacy by design,” incorporated into the LGPD in Article 46, paragraph 2, offers practical guidance for projects involving open data. When designing systems and processes that use public databases, protective measures should be built in from the planning stage, not added later as an extra layer. This principle applies both to developing technology applications and to structuring internal due diligence processes.

Emerging technologies also affect this balance. Techniques such as differential privacy, secure multiparty computation, and federated learning offer promising ways to extract value from open data without compromising individual privacy. Although not yet widely adopted in Brazil, these approaches represent the future of reconciling data openness with data protection, allowing robust statistical analysis without exposing personal information.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.