Data and Privacy in Agribusiness

1. Introduction

Agribusiness is one of the main drivers of the Brazilian economy and has been undergoing profound changes in its modus operandi over the last few years.

Technological advances have directly impacted agribusiness, and the use of technology for data collection and analysis is increasingly common in the agricultural market and has played an increasingly important role in the development of the sector.

With the development of new technologies, it has become possible to collect and analyze an increasing amount of agricultural data, covering information related to climate, soil, planting, harvesting, among other aspects.

This data analysis enables the creation of predictive models and algorithms that help in making more accurate and assertive financial decisions. For example, based on the information collected, it is possible to estimate the productivity of a crop, calculate the risk of losses, and define more efficient financial management strategies.

However, with the greater use of data – whether personal data or not -, responsibility for its use and processing increases.

1. Use of data in Agribusiness

New technologies used in agribusiness have different functions and come in different formats. One of the points in common between several of them, however, is the use of data during their use.

This data can be understood as general or can be characterized as personal data.

In this sense, it is important to distinguish personal data from other data that can be used in agribusiness. Personal data is all information relating to an identified or identifiable natural person. This can mean, for example, everything from databases containing the name, CPF, and address of farmers, to images of people captured by drones.

Data on soil moisture, data related to the harvest and weighing of cattle, for example, are “general” data, not considered as personal data by Brazilian legislation.

Thus, various data (whether personal or not) can be collected and used to develop and enhance agribusiness, whether with big data analysis, data collection by drones, autonomous equipment, use of management software, among others.

Based on this data, producers can make more strategic decisions, with greater assertiveness and confidence, which allows for an increase in productivity, a lower rate of waste and, consequently, an increase in the profit margin.

Agritechs play a fundamental role in this context, reducing costs and, above all, optimizing resources through studies and analyzes that offer unique solutions aimed at agribusiness. All this contributes to the evolution of the sector in a more efficient, productive, and sustainable way. Investing in integrated and connected technological solutions becomes increasingly essential, in addition to representing the future of agriculture.

Below are some examples of the use of data and its benefits in agribusiness:

• Irrigation management: The use of an automated irrigation system integrated with agricultural management software, which uses soil moisture sensors and satellite images, can be used to monitor the amount of water in the soil and the irrigation needs of crops. This can help farmers to monitor irrigation efficiency, optimizing water use, reducing costs, as well as aiding in decision-making.

• Soil monitoring: Satellite and drone images can be used to collect information such as soil composition, vegetation index, temperature of plants, their nutrients, acidity, and density. This information, when integrated with data analysis software, can help farmers to identify problem areas and take specific actions to correct these problems.

• Supply chain tracking: Tracking technology can be used to monitor all stages of agricultural production, from preparation to sale to the final consumer. This facilitates the tracking of possible sources of contamination, ensuring food safety.

• Monitoring of weather conditions: Integrated and connected technologies of climate sensors and weather stations, by collecting data on climate, temperature, soil moisture, precipitation, and other factors, can be used to help farmers to make informed decisions on planting, including regarding the amount of inputs such as agricultural pesticides and fertilizers needed, avoiding waste and promoting sustainability.

• Harvest forecast: Learning algorithms can be used to analyze historical harvest data along with weather data to predict current crop productivity. Such forecasts can help farmers to optimize planning about their harvesting operations, in addition to contributing to strategic decision-making and resource management.

• Market analysis: Collecting data on prices, demand, and supply of agricultural products helps rural producers to make decisions about the best time and place to sell their products, which generates greater profitability.

• Cattle monitoring: The collection of data on health, behavior, and location of cattle through GPS tracking devices and implantable sensors allows cattle breeders to effectively supervise their herd.

• Use of personal data in Agribusiness and LGPD

With the entry into force of the General Data Protection Law (Law No. 13,709/2018 – “LGPD”) in September 2020, everyone who processes personal data now has to follow a series of related rules provided for in the LGPD regarding the processing of such data.

Pursuant to the LGPD, any processing activity must be in accordance with the GDPR. Processing is the general nomenclature used to identify any operation carried out with personal data. Such operations include, but are not limited to, collecting, sorting, transferring, processing, storing, and deleting personal data. In practical terms, any operation carried out with personal data is a processing operation subject to the LGPD rules.

The rules provided for in the LGPD also apply to agribusiness, since this sector deals with a vast flow of personal data, which may be present at different times of the business, such as:

• Negotiations and contractual transactions
• Granting of rural credit and other lines of financing
• Management of service agreements
• Management of databases with information from input suppliers, customers, employees, business partners, etc.
• Partnership and lease agreements
• Technology research
• Working relationships

Faced with this new reality, compliance with the LGPD represents one of the great current challenges for Brazilian companies, especially in the agribusiness, with compliance with the law being essential in order to reduce the chances of possible lawsuits and administrative investigations, in addition to being essential to avoid reputational risks and loss of trust from customers and business partners.

In addition, compliance with the LGPD brings a competitive advantage over other competitors that do not comply with the law, in addition to enabling the company to contract with partners that require compliance with the LGPD as a requirement for contracting and participating in bids.

It should be noted that agribusiness is the sector that least adapted to the LGPD, according to a survey carried out by the Brazilian Association of Software Companies (ABES) and Ernest Young (EY). The study revealed that only 31.13% of agribusiness companies had adapted to the LGPD by August 2021.

It is important to highlight that the lack of compliance with the LGPD can subject the company to fixed and daily fines, with a total of 2% of its revenue and a limit of up to BRL 50 million, with the possibility of temporary limitation of personal data in more serious cases.

Thus, if it is identified that the company is processing personal data, it is extremely important to comply with the LGPD. In this sense, we listed below a step-by-step guide to assist agribusiness companies that intend to comply with privacy and data protection rules. This list is a general template that should be tailored to each organization’s specific needs, size, and risks:

• knowledge leveling: Initially, it is important to adopt actions that aim to level the knowledge of all employees about issues related to privacy and data protection. Training, workshops, and events that address the importance and basic concepts of the LGPD are highly effective for this purpose.

• Mapping: The second step consists of identifying the personal data processing flows of each sector of the company. Based on this information, it is necessary to internally document the information obtained and data flows identified – this documentation is a mandatory step in adapting to the LGPD. From the information obtained, it will be possible to preliminarily identify the level of maturity of the business in relation to the requirements and compliance with the LGPD.

• Action plan and Diagnosis: Based on the result obtained from the mapping of personal data and information flows, a work script must be prepared, which will include a diagnosis of LGPD requirements met or not by the organization. From the development of the action plan and diagnosis, it is possible to identify which documental and procedural changes should be implemented.

• Implementation: In the implementation phase, internal documents and procedures are created or reviewed for effective adaptation to the LGPD, identified in the previous phase. This step will include, for example, creating a privacy governance program, appointing a data protection officer, and reviewing or drafting corporate policies and supplier agreements. The implementation of a system that allows corrections and deletion of personal data, as well as the hiring of a qualified team prepared to handle the data are also relevant steps.

• Training and Maintenance: The culture of privacy and data protection must permeate business activities. Thus, guidelines regarding the acceptable use of personal data by the company must be retained in the organization’s internal documents but must also be continuously communicated through training and awareness actions. After reviewing the organization’s initial adaptation step, new products, services, and business processes must be continuously evaluated from an LGPD perspective. Maintaining compliance with the LGPD implies continuous work by the organization to assess the legality of its business practices, products, and services.

• Attention with suppliers: Another aspect that deserves attention from companies of the agriculture sector is suppliers. It is important to ensure that the supplier process the data appropriately, as an incident with data being processed by the supplier could affect the company’s data operated by the partner. To this end, companies must always assess the maturity of their suppliers in relation to the LGPD, by sending a privacy questionnaire and analyzing policies, in addition to entering into agreements regarding the processing of personal data containing all obligations, responsibilities, and rights of parts.

For companies that only need to adapt specific business processes, or that establish new processes, products, or services after the initial adaptation, it is extremely important to analyze these processes to assess possible risks and implement any necessary mitigation measures. For this purpose, it is possible to prepare a data privacy impact assessment (“RIPD”) or conduct a new adaptation process only in relation to the process in question.

The impact assessment, for example, is relevant when the processing operation is based on the legal basis of legitimate interest. However, its preparation must also be considered in operations that pose a high risk to data subjects or that involve a large amount of processed data. The RIPD will describe, for example, the processing agents involved, the processing procedures and the data processed, the methodology used to collect and store the data (including information security measures adopted), and will provide for measures, safeguards, and mechanisms to mitigate any risks.

The preparation of the RIPD is an opportunity for the organization to assess its level of compliance with the LGPD and demonstrate its commitment to the privacy and protection of personal data, both for data subjects and for the ANPD. Thus, the organization also demonstrates its commitment to the principle of accountability, complying with data protection regulations and demonstrating the effectiveness of all measures applied.

• Conclusion

As seen, technological advances directly impact agribusiness, so that the use of technology for data collection and analysis is increasingly common and plays a crucial role.

However, with the greater use of data, responsibility regarding the use and processing of these data increases, especially with regard to personal data.

Thus, adaptation to the LGPD is an important step not only to keep companies in compliance with the applicable legislation, but also to prevent risks to the image, brand, or business relationships with third parties from materializing, harming the business as a whole.

Despite the initial adaptation project being complex and robust, having experts to assist in the development and creation of governance in privacy and data protection is one of the most assertive ways to go through this stage.

The team of Campos Thomaz & Meirelles Advogados is prepared to assist its clients in the agribusiness market with matters related to technology and data protection and is always up to date with legislative news and available to offer advice on the subject.

share