The management of this topic started with the structuring of the Data and Analytics Management department, in 2019, and included the appointment of the Data Protection Officer (DPO), who is responsible for conducting internal activities to ensure compliance with the General Data Protection Act (LGPD, in Portuguese) and serve as a focal point between the Organization, the holders of personal data and the National Data Protection Authority (ANPD, in Portuguese).<\/p>\n\n\n\n
The Data Privacy and Protection Governance Program was created to mitigate potential negative impacts. As part of the Program, a quarterly report is sent to the Internal Audit for compliance reporting. The Program covers several fronts, including:<\/p>\n\n\n\n
\u2022 Mapping of all activities involving personal data processing, identifying the data life cycle, from collection to deletion, as well as the appropriate legal framework;
\u2022 Creation of a customer service channel for holders of personal data, ensuring the full exercise of all the rights set out in the LGPD;
\u2022 Formalization in a Standard of a flow of adaptation of contracts with third parties for compliance with the LGPD, including the definition of a methodology to help identify the Processor x Controller x Joint Controllers and define the flow for indicating LGPD clauses for business and administrative contracts;
\u2022 Implementation of the Privacy by Design and Privacy by Default methodologies in order to ensure the privacy and protection of personal data in the design of new products and services;
\u2022 Creation of specific guidelines for handling or responding to security incidents involving personal data considering the requirements imposed by the LGPD in order to complement Banrisul\u2019s existing Information and Cyber Security Policy; and
\u2022 Development of internal training for all the staff on the main points addressed by the Law and their impacts on the workplace, as well as creation of a website featuring content that helps disseminate a culture of data privacy and protection in the Institution.<\/p>\n\n\n\n
In order to address the actual negative impacts, Banrisul has approved the reporting flow of data breach incidents and created Guidelines for Prevention and Response to Personal Data Incidents. These documents are designed to ensure the prevention of personal data incidents related to Banrisul and its customers, including the means\/processes that should be implemented to mitigate and\/or remedy any adverse impacts thereof, as well as appropriately respond to and deal with these incidents.<\/p>\n\n\n\n
To track the effectiveness of the actions, quarterly reports are made to the Audit Committee and information is provided to any internal audits. The Bank organizes an annual calendar of activities of the Data Privacy and Protection Governance Program, covering all the goals and targets for the period.<\/p>\n\n\n\n
The plan is designed based on the Regulatory Agenda of the National Data Protection Authority and best market practices, taking into account sustainability aspects.The annual plan of the Privacy and Data Protection Governance Program defines indicators, which, after approved by the Executive Board, are submitted to and monitored by the Strategy and Planning department. The Program runs continuously.<\/p>\n\n\n\n
| \n Impact <\/th>\n | \n Classification (positive or negative) <\/th>\n | \n Event (potential or actual) <\/th>\n | \n Time frame (short-term or long-term) <\/th>\n | \n Systemic or one-time impact <\/th>\n | \n Irreversibility (high, medium, low - only for negative impacts) <\/th>\n | \n Production chain process or activity that causes impact <\/th>\n | \n Resources \/ stakeholder group impacted <\/th>\n <\/tr>\n |
|---|---|---|---|---|---|---|---|
| \n Incidents with customers\u2019 and employees\u2019 personal data <\/td>\n | \n Negative <\/td>\n | \n Actual <\/td>\n | \n Short-term <\/td>\n | \n Systemic <\/td>\n | \n Medium <\/td>\n | \n In the activities or database that uses customer personal data, in the event of a failure in data security systems. <\/td>\n | \n Shareholders and\u00a0Investors, Customers, Banrisul\u2019s Operations. <\/td>\n <\/tr>\n |
| \n Process credibility and credibility and sharing personal data <\/td>\n | \n Positive <\/td>\n | \n Actual <\/td>\n | \n Short-term <\/td>\n | \n Systemic <\/td>\n | \n - <\/td>\n | \n In information flow controls, through the preservation of confidentiality and integrity of information. <\/td>\n | \n Shareholders and\u00a0Investors, Employees, Customers, Suppliers, Banrisul\u2019s Operations. <\/td>\n <\/tr>\n |
| \n Greater autonomy for the holder to control personal data <\/td>\n | \n Positive <\/td>\n | \n Actual <\/td>\n | \n Short-term <\/td>\n | \n Systemic <\/td>\n | \n - <\/td>\n | \n Information availability, protected at all times, kept complete and available only to those entitled to access it. <\/td>\n | \n Shareholders\u00a0and Investors, Employees, Customers, Suppliers, Banrisul\u2019s Operations. <\/td>\n <\/tr>\n |
| \n Greater transparency as regards access and use of personal data <\/td>\n | \n Positive <\/td>\n | \n Actual <\/td>\n | \n Short-term <\/td>\n | \n Systemic <\/td>\n | \n - <\/td>\n | \n Availability and authorization to use the information only to those entitled to access it. <\/td>\n | \n Shareholders\u00a0and Investors, Employees, Community, Customers, Suppliers, Environment, Banrisul\u2019s Operations. <\/td>\n <\/tr>\n |
| \n Loss of market and competitiveness due to information security incidents <\/td>\n | \n Negative <\/td>\n | \n Potential <\/td>\n | \n Short-term <\/td>\n | \n One-time <\/td>\n | \n Medium <\/td>\n | \n Maintenance of Information Security. <\/td>\n | \n Shareholders\u00a0and Investors, Employees, Customers, Suppliers, Banrisul\u2019s Operations. <\/td>\n <\/tr>\n <\/table>\n<\/div> |