The government of Paraná reacted with surprise on February 23 to the previous day's decision by Minister Flávio Dino of the Supreme Federal Court (STF), which partially suspended the law authorizing the privatization of the Paraná Information and Communication Technology Company ( Celepar ) – the first state-owned data company to be offered to the private sector in the era of the General Data Protection Law ( LGPD ).

The auction, scheduled for March 17, became uncertain after Dino responded to a direct action of unconstitutionality (ADI) filed by two parties, PT and PSOL. The parties allege that the state law violates the Union's competence to legislate on data protection and infringes on the fundamental right to privacy.

Created in 1964, Celepar stores public data such as tax records, fines, and medical histories of citizens of Paraná, in addition to operating more than 35 state applications.

The minister understood that the law does not demonstrate sufficient safeguards and determined that Paraná should prepare a specific “data protection impact report” for the corporate transition, to be sent to The National Data Protection Authority (ANPD) will use the information "for analysis and suggestions purposes." Only after this will the full Supreme Court decide on the privatization.

The surprise from the Paraná state government stems from the fact that the Attorney General's Office (AGU) has expressed its support for state jurisdiction. "We hope there will be no politicization of this issue," Alex Canziani, Paraná's Secretary of Innovation, told NeoFeed .

"We will forward to the Supreme Court all the information regarding the personal data law that we previously provided to the State Court of Auditors (TCE)," he added.

The privatization process of Celepar, initiated in 2024, went through public hearings, approval in the Legislative Assembly, and analysis by the TCE (Court of Accounts), which even temporarily suspended the process.

After addressing all requests and dismissing three class action lawsuits, two direct actions of unconstitutionality (ADIs), and two writs of mandamus, the state government decided to publish the privatization notice in February, even with the ADI pending before the Supreme Federal Court – as the Attorney General's Office had expressed its support for state jurisdiction, the perception was that the issue was practically resolved.

In an interview two weeks ago, Canziani stated that the state government had taken all precautions to preserve the protection of citizens' data, as guaranteed by the LGPD (Brazilian General Data Protection Law), which prohibits its sale by the future private management company.

“The citizen is the data owner; the State, the controller; and Celepar, the operator. This structure will be maintained,” Canziani stated at the time. In this configuration, according to the LGPD (Brazilian General Data Protection Law), the controller decides what is done with the data, while the operator is limited to executing the processing, according to the controller's terms.

Emblematic case

Two LGPD experts interviewed by NeoFeed approached the topic differently. Rony Vainzof, partner at the law firm VLK Advogados, states that Dino interpreted the law in accordance with the Constitution, maintaining the law but conditioning its application on compliance with the LGPD and Law 13.675/2018, which deals with the National Public Security and Social Defense Policy (PNSPDS).

“In practice, the minister understood, cautiously, that the privatization must comply with the LGPD (Brazilian General Data Protection Law) and PNSPDS (National Public Security Policy); the State of Paraná must preserve control over systems and databases of sensitive personal data and those related to public security, prohibiting their complete transfer to private entities,” says Vainzof.

According to Dino's interpretation by the expert, the State must maintain direct supervisory powers over the processing of this data, without prejudice to the competence of the ANPD (National Data Protection Authority); furthermore, a specific Data Protection Impact Assessment (DPIA) report for the corporate transition must be prepared before the privatization process proceeds, to be submitted to the ANPD.

Fernando Gallacci, infrastructure partner at the law firm Souza Okawa Advogados, on the other hand, points out that the case is emblematic because it is the first concrete discussion about the privatization of a state-owned data company after the federal government abandoned the idea of privatizing the Federal Data Processing Service ( Serpro ), a public technology company of the federal government.

“This is, first and foremost, about the return of the privatization discussion, but now tempered by the debate over personal data held and organized by state-owned companies,” says Gallacci. “It’s a new market, and as such, it has faced considerable discussion in order to understand its limits and opportunities.”

According to him, it does not seem that, legally, the suspension of the proceedings should prosper. Thus, the precautionary decision should follow others already made in the Celepar case, with review by the collegiate body.

“It is difficult to find abstract unconstitutionality in the simple privatization of Celepar; the Constitution does not prohibit this type of privatization, nor does the infra-constitutional legislation, which only delimits safeguards for the private operation of data collected within the scope of public services – and, it is worth mentioning, whose private management already occurs in several contracts under the custody of the public authorities,” he adds.

According to Gallacci, it is sufficient for the privatization law to expressly state that the process of selling control of Celepar should comply with the LGPD (Brazilian General Data Protection Law) and other information security standards, preserving public services, to resolve the issue raised by Minister Flávio Dino. "The matter will be closed in the manner proposed by the Attorney General's Office, with a simple interpretation in accordance with the Constitution."

According to the expert, the issue will likely be resolved in legal abstractions, but will resurface in the details – where, according to him, the devil always lies.

“The crux of the discussion will come when detailed studies are conducted and the call for tenders is published, outlining the rules of this new personal data market based on private sector support for the processing of data collected in the course of exercising state functions,” says Gallacci. “The real battle will lie in the details.”

Secretary Canziani, in turn, compares the minister's distrust of the management of personal data to be kept by the privatized Celepar with the leniency of the public authorities when a Serpro employee leaked data from INSS retirees – used mainly for abusive offers of payroll loans.

"This is a public company that had data leaked, but, regardless of any discrepancy, if it were a private company, there would be a heavy fine for it," he says. For now, there is no news of punishment for the Serpro public employee or the agency itself.