The data protection concern has become, in recent years, more strong and important, with the coming into force of laws dealing with the subject.
The beginning of the whole discussion occurred with the enactment of Law No. 12,965/2014, better known as the "Brazilian Civil Rights Framework for the Internet", which establishes principles, guarantees, rights and duties for the use of Internet in Brazil.
In addition, was enacted Law No. 13,709/2018, which exclusively provides for the protection of personal data and was amended by Provisional Measure 869, dated December 27, 2018, which also established a deadline of 24 (twenty four) months for the entry into force of the provisions set forth by Law No. 13,709/2018.
In this sense, companies have until August/2020 to organize and create mechanisms for the protection of their customers', suppliers', employees' and service providers' personal data.
Specifically, in the context of employment relationships, it is essential that companies treat the personal data of candidates, employees and service providers very carefully in order to avoid the application of the substantial fines provided for in the legislation, which can reach 2% of the company's, group' or conglomerate' revenues in Brazil, in its last fiscal year, limited to the surprising amount of R$ 50 million.
That is, the amount arbitrated as a fine for non-compliance with the General Data Protection Law already demonstrates the importance of the subject nowadays and the dimension of the precaution companies must have when dealing with the personal information that is made available to them.
In general terms, law defines, as personal data, any information related to the natural person identified or identifiable (name, address, telephone, taxpayer number, etc.) and sensitive data as any personal data with a higher discriminatory potential (racial or ethnic origin, religious belief, medical condition, political opinion, union membership, sexual orientation, etc.).
In this way, as from the first contact with a candidate for a job position, the company must deal with the personal information received with full responsibility, and it is imperative to request only essential data for a specific purpose and suitability, without excess, to avoid future allegations of discrimination in hiring, for example.
To do so, an example of a measure aimed at protecting the company against this type of allegation would be the adoption of clear forms that evidence...