The recent decision by the National Data Protection Authority (ANPD), which imposed a fine of R$ 153,7 million on TikTok's parent company for irregularities in the processing of personal data of children and adolescents, serves as an important warning for companies: in matters of data protection, compliance is not limited to the formal existence of policies, procedures, and controls.

In addition to the financial penalty, the ANPD ordered the deletion of the personal data collected irregularly. Additionally, there are several leisure, determined the implementation of a compliance plan. In this senseThe goal is to improve measures to protect children and adolescents on the platform.

Among the irregularities identified by the Authority, the following stand out: The carrying out of processing operations without a valid legal basis and the insufficiency of measures designed to prevent harm to data subjects. Additionally, there are several leisureThe ANPD (National Data Protection Authority) identified a lack of concrete evidence capable of demonstrating the effectiveness of the technical and organizational measures adopted by the company.

From formal compliance to demonstrable compliance.

One of the most relevant aspects of the decision lies precisely in evaluating the effectiveness of the mechanisms adopted by the platform.

The LGPD (Brazilian General Data Protection Law) establishes, among its principles, accountability and transparency, requiring data processing agents not only to adopt effective measures to ensure compliance with data protection regulations, but also to demonstrate the effectiveness of these measures. In this context, the existence of a privacy policy, internal procedures, or formally established controls represents only a part of the structure necessary for compliance.

It is necessary to effectively incorporate these mechanisms into operations, adapt them to the risks involved, and monitor their application with evidence demonstrating their practical effectiveness. This requires a continuous governance logic: identifying risks, establishing controls, implementing them, monitoring their effectiveness, documenting the results, and reviewing the measures whenever necessary.

Data protection must be built into the operation.

This case also highlights that data protection cannot remain restricted to the legal or compliance area. Companies need to consider the risks related to the processing of personal data within the very structure of their products, services, processes, and user journeys.

In the case analyzed by the ANPD (National Data Protection Authority), the authority evaluated, among other aspects, the mechanisms used by the platform. These mechanisms sought to prevent the inappropriate processing of children's and adolescents' data. They also aimed to prevent access to or registration of this public in situations incompatible with applicable rules.

The discussion, therefore, goes beyond the content of legal documents and reaches the effectiveness of existing controls in the operation itself. For companies that develop digital products and services, this perspective reinforces the importance of incorporating data protection from the conception of processes and solutions. In this context, companies must adopt technical and organizational measures proportionate to the identified risks.

Children and adolescents at the center of regulatory attention.

Another relevant aspect is the public directly involved in the case. The protection of personal data of children and adolescents has been occupying an increasingly prominent place on the Brazilian regulatory agenda, especially in light of the entry into force of the Digital Statute for Children and Adolescents (ECA Digital) and the intensification of the ANPD's (National Data Protection Authority) oversight activities in the digital environment.

Companies whose products or services may be accessed by children and adolescents must, therefore, specifically assess the risks associated with this audience. This analysis may involve, depending on the nature of the activity, age verification mechanisms, privacy settings, parental controls, advertising rules, risk prevention measures, and procedures capable of demonstrating the effectiveness of the safeguards implemented.

What can companies learn from this case?

The decision involving TikTok reinforces an important trend in regulatory action: data protection compliance must not only be implemented, but also demonstrable.

In practice, companies that process personal data should be able to answer questions such as:

• What are the main privacy risks related to our operations?
• What controls have been implemented to mitigate these risks?
• How do we verify that these controls actually work?
• What evidence documents its application?
• Are the controls periodically monitored and reviewed?
• There are specific measures in place for operations involving large groups of people or treatments requiring greater attention.
  crag?

These issues help transform essentially documentary privacy programs into effective governance and risk management structures. More than simply having adequate policies, therefore, the challenge becomes building a structure capable of demonstrating that data protection measures are proportionate to the risks, that the company effectively incorporates them into its operations, and that it continuously monitors them.

The TikTok case signals that, given the maturing role of the ANPD (Brazilian National Data Protection Authority), the ability to demonstrate the effectiveness of controls is likely to occupy an increasingly relevant position in assessing the compliance of organizations.

Source: https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-multa-tiktok-em-r-153-7-milhoes-por-falhas-na-protecao-de-dados-de-criancas-e-adolescentes