backNewsletter (#009/2025) on Privacy and Data Protection by Campos Thomaz Advogados
Alerts, materials, and updates on Privacy, Data Protection, and Cybersecurity.
To subscribe, click here.
Find out more about our DPO as a Service
We have prepared specific material to explain how the external DPO as a Service works. Contact our partners
Adequacy Decision in International Data Transfers
The adequacy decision is a mechanism established under both the European Union’s General Data Protection Regulation (GDPR) and Brazil’s General Data Protection Law (LGPD). It allows personal data to be transferred between countries without requiring additional safeguards, provided that the receiving country ensures a level of protection equivalent to that of the country of origin. This recognition facilitates international data flows, provides greater legal certainty for organizations, and strengthens the protection of data subjects’ rights. Learn more.
ANPD releases first report on the 2025-2026 Regulatory Agenda
On September 8, 2025, the Brazilian National Data Protection Authority (ANPD) issued the first Monitoring Report on the 2025-2026 Regulatory Agenda, covering the first semester of 2025. Prepared by the General Coordination of Standardization (CGN), the report underscores ANPD’s commitment to proactive transparency and accountability to society.
The document provides details on the progress of initiatives included in the Agenda, with emphasis on Phase 1, which consolidates projects carried over from the 2023-2024 Regulatory Agenda, originally approved by Ordinance No. 35/2022 and later amended by Resolution CD/ANPD No. 11/2023. This publication complies with Article 7, §6, of Ordinance CD/ANPD No. 16/2021, which requires semiannual reports to publicize regulatory progress and foster institutional dialogue. Learn more.
Chamber of Deputies approves urgency request for bill on facial recognition cameras
On August 26, 2025, the Chamber of Deputies approved an urgency request for Bill No. 1828/2023, introduced by Congressman Rodrigo Gambale (PODE-SP), which authorizes the installation of facial recognition cameras in high-traffic areas such as railway and bus stations, subways, public roads, and government offices. The stated purpose is to support law enforcement in locating fugitives, missing persons, and investigating crimes. With the urgency approval, the bill may be voted directly in the plenary without prior review by Chamber committees. Learn more.
Senate approves Digital Statute for Children and Adolescents to protect minors in online environments
The Senate approved Bill 2,628/2022, which creates the Digital Statute for Children and Adolescents and sets rules to protect minors in digital environments. The proposal requires providers to immediately remove content involving child abuse or exploitation and notify authorities; mandates age verification (self-declaration is prohibited) and parental-control tools with maximum protection by default—such as blocking contact with unauthorized adults, limiting features that encourage excessive use, and restricting geolocation. Platforms with more than 1 million underage users must publish semiannual reports on moderation and risk. The text also bans targeted advertising to children and teenagers and the use of emotion analysis or AR/VR for that purpose, and restores a prohibition on “loot boxes” for minors. Learn more.
Government regulates TV 3.0 through Decree No. 12.595/2025
On August 27, 2025, brazilian President signed Decree No. 12,595/2025, which regulates TV 3.0 — also referred to as DTV+ — setting the new standard for open and free-to-air television in Brazil. The technology adopts the ATSC 3.0 standard, enabling ultra-high-definition imagery (4K and 8K), immersive audio, interactivity, and internet integration, as well as features such as accessibility, emergency alerts, and digital public services. Learn more.
OpenAI announces introduction of parental control tools in ChatGPT
On September 2, 2025, OpenAI announced that starting in October it will roll out new parental control tools in ChatGPT. The initiative is part of a broader set of measures the company plans to implement over the next 120 days, aimed at addressing mental health concerns and ensuring safer use of the platform by teenagers. Under the new system, parents and guardians will be able to link their accounts to those of children aged 13 and older, set usage parameters, manage or disable features such as memory and chat history, and receive alerts when interactions reveal signs of emotional distress. Learn more.
Hacker attack diverts BRL 710 million from PIX environment operated by Sinqia
On August 29, 2025, Sinqia, a company responsible for connecting financial institutions to the PIX system, suffered a hacker attack that resulted in the diversion of approximately BRL 710 million in unauthorized transactions. According to a report submitted by its parent company, Evertec, to the U.S. SEC, the breach exploited credentials of legitimate IT providers. The most affected institutions were HSBC, with around BRL 670 million diverted, and fintech Artta, with approximately BRL 41 million. The Central Bank stated that about 83% of the amount had been blocked. Learn more.
FTC accuses Disney of COPPA violations; company settles for BRL 54.7 million
On September 3, 2025, Disney agreed to pay BRL 54.7 million in a settlement with the U.S. Federal Trade Commission (FTC). The regulator accused the company of violating the Children’s Online Privacy Protection Rule (COPPA) by failing to properly label certain YouTube videos as “made for kids.” According to the FTC, this omission resulted in the unlawful collection of children’s personal data and exposed minors to features considered inappropriate for their age group. Learn more.
LGPD Infographic
Access the LGPD infographic prepared by our firm. Access here
Explore our series of content on privacy, data protection, and cybersecurity.
Discover our series of content on privacy, data protection, and cybersecurity. Access the full series here.
Produced by Alan Campos Thomaz and João Marcelo de Oliveira
share
