Data is fundamental to almost all our daily activities. To communicate with one another, to access files in our electronic devices, or to determine if our commercial partners or suppliers are growing crops on illegally deforested land, we need to process data.

When Brazil's General Data Protection Law (LGPD – Lei Geral de Proteção de Dados Pessoais) came into force, the market became intensely concerned over the collection, analysis, processing and sharing of personal data, since the legislation establishes criteria and requirements for those activities.

In particularly, in order to lawfully process personal data, organizations must have a legal basis to do so, as provided for under article 7 (non-sensitive personal data and article 11 (sensitive personal data) of the LGPD.

With these initial considerations, the question is this: given the current legislation on protection of personal data, can organizations make trade agreements designed to promote reduction of deforestation by requiring the parties to the contract to check if organic crops are grown on illegally-deforested land?

Most of the time, conducting this kind of check would involve processing the personal data of the farmer and the owner of the land on which the crop was planted. Although the information may relate to legal entities, there is a significant number of farmers who own the land on which they grow their crops.

In such cases, in order to fulfill their obligation to check whether land has been illegally deforested, or whether suppression of vegetation has been authorized, the parties to the trade agreement will need to request documents that contain personal data, which in turn will attract application of the General Data Protection Law.

For example, if the check involves examining Vegetation Suppression Authorizations, those documents will probably reveal the complete name of the owner of the land, the owner's tax I.D., the property's address and, in some cases, additional information such as a telephone number and a registration number with administrative authorities.

Even so, there are reasonable arguments to support the position that processing personal data in such situations would not violate the LGPD, so that that this type of obligation or condition (deforestation checks) can be included in supply agreements.

First, the LGPD was not created to prevent processing of personal data or to make it impossible to engage in activities that involve data processing. On the contrary: the legislation simply establishes the rules of the game for data processing, and its foundations are not only on respect for privacy, but also economic and technological development, innovation, human rights and free enterprise.

Second, given that the overriding objective of the deforestation check obligation is to ensure that the organizations that are party to the trade agreement do not acquire organic products grown on illegally-deforested land, not just the organizations but society as a whole can be said to have a legitimate interest in processing the personal data. After all, buying products grown on deforested land only serves as an incentive for more environmental aggression, and defense and protection of the environment is a collective obligation under article 225 of Brazil's Constitution.

Just as in any situation where legitimate interest is the legal basis used to process personal date, the requirements under article 10 of the LGPD must be met, such as assessing the facts of the situation and the legitimate expectations of data subjects, and limiting processing to the data that is strictly necessary to the data processer's purpose. If these limitations are respected, the LGPD should not be an obstacle to protection of the environment.