A compreensão dos profissionais de TI quanto à lei geral de proteção de dados pessoais e suas implicações nas organizações - estudo de caso SENAC

Abstract

Technological evolution is based on bringing countries and societies closer together, facilitating communication, reducing distances and bringing cultural differences closer together. However, the collection and manipulation of data through technological resources make possible the misuse and abuse by people and organizations. Information vulnerability is a social issue. Therefore, it requires greater control over information security policies. However, current controls are not enough to prevent the abuses that the digital world provides. In increasingly connected environments, legal controls and regulations are essential to avoid the arbitrariness that excessive use of information can generate for organizations and/or individuals. Considering the excessive use of information, countries have instituted laws and rights that underlie the use and control of collected personal data. In Brazil, the requirements of Law 13.709 of 2018, known as the General Law for the Protection of Personal Data (LGPD), involve different changes in approach to an organization's information security measures. Subject to the requirements of the Law, public, private and parastatal organizations need to consider these changes in their technological infrastructure and information security, in addition to other control measures, through information security policies to ensure the protection of personal data, aiming the right to privacy of its customers, employees, partners and suppliers, also considering that compliance with the Law is based on people, processes and technologies. The adaptation of the Organizations regarding the legal requirements as an instrument of control and monitoring of personal data requires restrictive measures of the Information Security Policy. For this, it is necessary to verify the understanding of IT professionals regarding risk management in the inappropriate use of data and the new roles and responsibilities that the Law defines, transparency, the dissemination of knowledge in organizations, regulations and the treatment of information, observing the ethical issues of IT professionals, with regard to the privacy of personal data on their custody and responsibility. This work aims to identify how IT professionals understand the requirements of the LGPD and its implications for organizations, in addition to the need to adopt information security controls. Thus, quantitative and qualitative researches were applied, through a Survey questionnaire, with approximately 70 IT managers from SENAC in Brazil, evaluating the impacts of the LGPD in the data controls in their organizations. After tabulation and statistical analysis of the survey, the results were presented in a Focus Group, mediated in a virtual format through the Teams tool, with the participation of 16 Strategic IT Managers from SENAC from 7 States of Brazil, when opinions and considerations regarding the result of the applied research. At the end of this work, with the consolidated diagnoses, the assessments were carried out, considering the assumptions of the research in which it was evident that the understanding and awareness of IT professionals are relevant to the adjustments required by Law, regarding the security of information in organizations. The work exposed the possible impacts, in addition to the opportunities that Law 13.709/2018 may generate in Information Technology Governance (GTI) and Information Security (IS) controls, with a view to mitigating, risking and reducing vulnerabilities of personal data processed in organizations.