# Professional Guidance of the DPOs-BR in Corporate Governance in Logistics Chains

Liliam Sayuri Sakamoto, Jair Minoro Abe, Jonatas Souza, Nilson Souza, Aparecido Carlos Duarte, Edvania Tarkiainem, Luigi Lima

## ► To cite this version:

Liliam Sayuri Sakamoto, Jair Minoro Abe, Jonatas Souza, Nilson Souza, Aparecido Carlos Duarte, et al.. Professional Guidance of the DPOs-BR in Corporate Governance in Logistics Chains. IFIP International Conference on Advances in Production Management Systems (APMS), Sep 2022, Gyeongju, South Korea. pp.57-65, 10.1007/978-3-031-16411-8_8. hal-04768944

HAL Id: hal-04768944

https://inria.hal.science/hal-04768944v1

Submitted on 6 Nov 2024

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Professional guidance of the DPOs-BR in corporate governance in logistics chains

Liliam Sayuri Sakamoto¹[0000-0001-8636-0100], Jair Minoro Abe²[0000-0003-2088-9065], Jonatas Santos de Souza³[0000-0002-0052-0132], Nilson Amado de Souza⁴[0000-0003-1092-4314], Aparecido Carlos Duarte ⁵[0000-0002-3278-3471], Edvania Tarkiainem ⁶[0000-0002-6730-9315], Luigi Pavarini de Lima ⁷[0000-0003-1780-25710]

1,2,3,4,5 Paulista University, 1212, Dr. Bacelar Street, São Paulo SP, BRAZIL

⁶ IMF Smart Education, 25, Bernardino Obregón Street, Madrid, España

⁷ Institute of Mathematics and Statistics (IME) - University of São Paulo - USP, 1010, Matão Street, São Paulo SP, BRAZIL

**Abstract.** Currently, DPO (Data Protection Officer) professionals are working in sectors of the economy in the adaptation of the LGPD (Brazilian General Data Protection Law) in Brazil with the use of best management practices. Companies with consolidated corporate governance admit the incorporation of the LGPD (Brazil's General Data Protection Law) into their strategy, with highly trained professionals to consolidate leadership and monitor results. The commitment to enhance the structures that serve logistics companies is preferably used only by highly trained professionals, including internationally. In this sense, it was sought to list points that the sector should develop throughout the adaptation and especially in a continuous way to help achieve the objective within the institution. Data provided and collected in 2022 by the ANPPD (National Association of Data Privacy Professionals) from the almost 4 thousand (associates) trained professionals working in the Brazilian market show us that service sectors (50%) are using professionals trained in the LGPD, as well as in commerce (17%), in the industry (15%), in other segments (14%), and even showed in particular growth in agribusiness (4%) of professionals both in awareness and adaptation of the LGPD. And as strengths that must be followed in both awareness and adequacy, are the continuous improvement in acculturation processes, creation of orientation guides, training, until its implementation by outsourcing (DPO-as-a-Service), and professional responsibilities trained in LGPD and recognized by the CBO (Brazilian Classification of Occupations).

**Keywords:** Brazilian General Data Protection Law, Protection, logistics, Corporate Governance, Professional Guidance.

## 1 Introduction

Identifying the core recognition aspect and its risks sectors in internal and external controls in corporate governance is one of the improvement challenges to DPO – Data Protection Officer in the enterprises in Brazil in compliance with LGPD (Brazil's General Data Protection Law) [3]. The external segments can be converted into better observance throughout Society, with a focus on Corporate Social Responsibility.
In Brazil, advances achieved by the capital market in Brazilian companies began with the Law nº 6.404/1976 and the creation in 1976 of the Brazilian Securities and Exchange Commission, like SEC - Securities and Exchange Commission in the USA. In 1995 with the Brazilian Institute of Corporate Governance (IBGC), and later in the 1988 Constitution [4] and with the national environmental policy. Brazilian business sectors are using the best market practices through Corporate Governance of Information and Technology with the support of specialists recognized by the Brazilian Classification of Occupations [5]. This study aims to elicit the main sectors of the Brazilian economy that are acting in the awareness, adequacy of LGPD and motivators of regulations as well as guidance by experts in LGPD in supply chain too.

## 1.1 Corporate Governance

Corporate Governance is due to the fact of mitigating misconduct that occurs within the Companies. The path pursued by the implementation and continuous improvement is based on its level of quality (transparency in business conduct, trained professional), and adequacy to regulation. And so, the guarantee of shareholders' rights is allowed [6].

Researchers point out that Corporate Governance allied to Corporate Social Responsibility and Information Technology (IT) brings significant gains for all those involved (Company Departments, Shareholders, Society). Therefore, when implemented by trained managers [10] internationally to work in the public and private sectors. Corporate Governance allied to Information Technology contributes to the improvement of Brazilian companies, as it allows providing all necessary support for strategic definitions under the responsibility of top management. In other countries, this contribution creates many governance innovations for assertive decisions.
COBIT 2019 is a Framework with a structure of Governance and Management internal control objectives [11], it is divided into two parts that address the corporate aspects that are Governance and Management. This guideline helps integrate standards, other guidelines, regulations, and best practices like Six Sigma, ITIL, PMBOOK, Sarbanes-Oxley regulations and community contribution.

Each part is organized into domains, in the Governance part there is only 1 domain and in the Management part, there are 4 domains. In EDM - Evaluate, Direct, and Monitor - Governance domain, there are 5 objectives: Ensured Governance Framework Setting and Maintenance, Ensured Benefits Delivery, Ensured Risk Optimization, Ensured Resource Optimization, and Ensured Stakeholder Engagement [11].

In Management 4 domains: APO - Align, Plan and Organize, BAI - Build, Acquire and Implement, DSS - Deliver, Service and Support, and MEA - Monitor, Evaluate and Assess, there are 35 control objectives. Inside its control objective, there is a description, and this purpose is described as a waterfall model, beginning with Enterprise Goals and this corporate alignment, with example metrics for each enterprise goal match to other example metrics for alignment goals [11].

It Control objective is organized by processes or tasks with organizational structures (Information Flows and Items) and presents the detail of people, skills, competencies, policies, procedures, culture, ethics and behavior, services, infrastructure, and applications. The innovation in this COBIT 2019 version is the addition of Design Factors and
Focus Area to tailor the framework to priority objectives, adapt the guidance from the specific focus area, and target the capability and performance customized for each organization, see fig.1 [11].

<figure><img src="image_3.png" /><figcaption>Fig. 1. COBIT 2019 Framework [11]</figcaption></figure>

IT Governance Models have been highlighted with the use of frameworks (Model of the Center for Information Systems Research (CISR) of MIT, COBIT 2019 - Control Objectives for Information and related Technology of ISACA- Information Systems Audit and Control Association, Corporate Governance of Information and Technology) as a means of support [11], with a focus aligned with the Company's business. In COBIT 2019, the corporate objectives in item 03 (EG-Enterprise Goals) stand out for dealing with the financial part and its compliance with external laws and regulations.

In COBIT® 2019, one of the models [11] used by Brazilian companies with an emphasis on the design factor, corporate objectives (EG-Enterprise Goals), and especially in the 19 risk categories shown in table 1 [11]. These risks must be addressed by the DPO, which will be one of the main governance actors.

<table><caption>Table 1. Risk Category COBIT® 2019.</caption><thead><tr><td>Item</td><td>Risk Category</td></tr></thead><tbody><tr><td>1</td><td>Making IT investment decisions</td></tr><tr><td>2</td><td>Program and project lifecycle management</td></tr><tr><td>3</td><td>IT costs and oversight</td></tr><tr><td>4</td><td>IT expertise, skills, and behaviors</td></tr><tr><td>5</td><td>Enterprise IT Architecture</td></tr><tr><td>6</td><td>IT operational infrastructure incidents</td></tr><tr><td>7</td><td>Unauthorized Actions</td></tr><tr><td>8</td><td>Software adoption and usage issues</td></tr><tr><td>9</td><td>Hardware Incidents</td></tr><tr><td>10</td><td>Software Flaws</td></tr></tbody></table>
11 Logical Attacks

12 Third party and supplier incidents

13 Incompatibility

14 Geopolitical Issues

15 Industrial action

16 Action of Nature

17 Technology-based innovation

18 Environmental issues

19 Data and information management

## 1.2 Supply Chain Management and Logistics

A Supply Chain Management (SCM) is characterized by the standardization of operations integrated with several processes of purchase/sale, transport, storage, and distribution. This supply chain deals with flows and information [2] and is subject to compliance with the LGPD [3] because sensitive data travel between internal and external processes.

One of the bottlenecks in Brazil in terms of logistics costs is in agribusiness due to the production volume and distances between those who produce and their destinations. The sector in constant evolution seeks improvements in its processes with a Corporate Governance in the adaptation of commercial partners, suppliers, and farmers to adequate social-environmental practices.

Agribusiness evolves and updates itself, as does the awareness [17] of LGPD by trained DPO professionals [16] and its importance [18]. New processes are attributed to the use of the Artificial Intelligence technique [15] for prediction as support, and analysis [19]. Faced with these technological advances in the agribusiness sector, there has been a significant improvement in decision-making.

The adequacy of the LGPD [3], by producers still treated with costs, move towards the awareness of understanding as an investment, since agribusiness deals from confidential information of employees, suppliers, and customers to the culture of using paper to record personal data that are subject to LGPD [3].

Precision agriculture is also a point of attention as they are susceptible to data leaks and the possibility of having their entire operation interrupted. In this sense, as a response, the sector incorporates Corporate Governance allied to Information Technology.

In systemic terms, a strong ally in the supply chain is the ERP Enterprise Resource Planning tool for logistics [12] that allows numerous advantages, such as real-time information, identification of bottlenecks in processes, better inventory control, reduction in delivery time, compliance with the LGPD [3].

Professional DPOs guide the use of ERP systems approved by the association [1] with methodological quality [7] in their evaluation, as it has been a differential in standardization, and data integration as support in the adequacy by the small company.

And another differentiator for the DPO in the supply chain is knowing about KGM - knowledge governance mechanisms [14] using agri-food supply chain (AFSC) [8].
1.3 LGPD Regulation

Amends the Federal Constitution [12] to include the protection of personal data
among fundamental rights and guarantees and to establish the exclusive competence of
Brazil to legislate on the protection and processing of personal data.

The regulation of the Law in Brazil has been used as a complement to the under-
standing of the Law. It is worth remembering that no regulation takes away the right of
the Law, as there are always unfounded attempts by parts of regulatory authorities.

We have recently managed to advance and regulate small businesses: Resolution CD/ANPD [13]. Approves the Regulation implementing Law No. 13.709, of August 14, 2018, General Law for the Protection of Personal Data (LGPD) [3], for small treatment agents (micro-companies, small companies, startups, legal entities governed by private law, including non-profits organizations).

In terms of regulations and ordinances, we are at the beginning because we have a
long way to go on several points such as the definition of the Anonymization tech-
nique[17], portability standard, legacy base sharing, international agreements for data
transfer, revocation in the punishment of DPO, among others in its Art.41, §2, III [3],
violations in the Brazilian electoral context, and including the performance of inspec-
tion by the recently created National Data Protection Authority (ANPD).

Main Motivator for Regulation of the LGPD [3]. Much is researched on the real reasons that lead companies to adhere to adequacy after the awareness stage. The result of a discussion on the topic "Motivator for Regulation" is elicited (see Fig. 2) and shows that the main one is the fear of Fines (36%), followed by Pressure from Customers (26%), Pressure from Customers Regulators (24%), Employee Pressure (10%), International Pressure (2%), Others (2%).

<figure><img src="image_4.png" /><figcaption>Fig. 2. Main motivator for regulation of LGPD in Companies. (Author).</figcaption></figure>
## 2 Methodology

The methodology used was the literature review of Corporate Governance, LGPD Regulation e Supply Chain Management and Logistics. It was allied to an analysis of exploratory statistical research conducted by ANPPD on the training of professionals working with data protection and privacy, such as DPOs, mainly working in the supply chain area.

## 3 Professional guidance for DPOs

### 3.1 Data Protection Officer occupation

In 2016 in Europe, the European Regulation on Privacy of Personal Data [9] was created and served as a model in 2018 for Brazil. This model was the basis for the creation of the General Law on Personal Data Privacy-LGPD [3]. The purpose of the Law is to protect the fundamental rights of freedom and privacy and the free development of the personality of the natural person.

The LGPD – General Personal Data Privacy Law [3] was authorized in 2018, sanctioned by the then President of the Republic Michel Temer on August 14, 2018, taking full force in 2020.

The laws agree that for companies to adapt, it is necessary to involve areas such as IT/Information Security and regulation. And for that, they bring as a requirement a professional responsible for the privacy of personal data, the Data Privacy Officer in Brazil, known worldwide as DPO – Data Protection Officer.

And by LGPD Law in its Section II - Person in Charge of the Processing of Personal Data, its Art.41, §2, III [3] the professional is responsible for guiding and acting in the activities: accept complaints, receive communications, guide employees, and perform other duties. Important and recognized functions [5] by the Brazilian Classification of Occupations.

The Brazilian Classification of Occupations – CBO [5], established by ministerial decree no. 397, of October 9, 2002, aims to identify occupations in the labor market, for classification purposes with administrative and household records:

* CBO Code: 1421-35 – Personal Data Protection Officer.
## 3.2 Profissional training

And as strengths that must be followed in awareness and adequacy, they range from continuous improvement in acculturation, and guidance guides, to their implementation by outsourcing and responsibilities of the professional training in the LGPD [3]. These points are the major contribution of DPOs in Brazil as recognized by the CBO [5] (Brazilian Classification of Occupations) body. Due to the recognition of the profession, there is also a growing demand in the service format (DPO as a Service) in hiring a data privacy specialist to fill the role, ensuring compliance with a fundamental point of the General Data Protection Law[17].

About Sector with DPO, Brazilian companies shown in table 2 reflect the use of IT support (Information Technology). The professionalism of the DPO has been a benchmark among the sectors. The service sector has come out ahead with 50% of the market, just as agribusiness already appears in the survey as initially active with DPO.

<table><caption>Table 2 IT Governance Sectors - 2022 (Author).</caption><thead><tr><td>Item</td><td>Sector</td><td>Representation</td></tr></thead><tbody><tr><td>1st</td><td>Services</td><td>50%</td></tr><tr><td>2nd</td><td>Business</td><td>17%</td></tr><tr><td>3rd</td><td>Industry</td><td>15%</td></tr><tr><td>4th</td><td>Others</td><td>14%</td></tr><tr><td>5th</td><td>Agribusiness</td><td>4%</td></tr></tbody></table>

## 4 Conclusion

This research study presented training on data privacy controls to DPO professionals in controllers to help reduce the penalty of fines (36%).

Another point raised in this semester of 2022 was the emergence of agribusiness (4%) in the search for awareness and adequacy of the LGPD through trained professionals. The data showed that lessons learned by the Corporate Governance of Information and Technology are standing out in the service sector (50%) in the pursuit of LGPD.

## Acknowledgements

We thank the research group Paraconsistent logic and artificial intelligence maintained by the Paulista University and conducted by researcher Dr. Abe. This study was financed in part by the Coordination for the Improvement of Higher Education Personnel - Brazil (CAPES) -Financial Code 001.

## References

1. ANPPD - Associação Nacional dos Profissionais de Privacidade de Dados. Available in: https://anppd.org/noticia/anppd-homologa-seu-1-software-para-conformidade-a-lgpd-09-09-2021. Accessed on: 11/02/2021.

2. BALLOU, R.H. Gerenciamento da cadeia de Suprimento/Logística Empre-sarial, 5ºEd., Porto Alegre, 2006.

3. Brasil. Lei Geral de Proteção de Dados Pessoais (LGPD). Lei nº 13.709, de 14 de agosto de 2018. Available in: http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709.htm. Accessed on: 09/02/2022.
4. Brasil. Constituição Federal, de 1988. Available in: http://www.planalto.gov.br/cci-vil_03/constituicao/constituicao.htm. Ac-cessed on: 09/02/2022.

5. CBO - Classificação Brasileira de Ocupações - 5.1.7 (mtecbo.gov.br). Avail-able in: https://anppd.org/noticia/cargo-de-dpo-agora-tem-cbo-03-08-2021. Accessed on: 1 fev. 2022.

6. CRISÓSTOMO, V. L.; BRANDÃO, I. F. The ultimate controlling owner and corporate governance in Brazil. Corporate Governance: The international journal of business in society, 19, n. 1, p. 120-140, 2019.

7. DE ALENCAR NÄÄS, IRENILZA; LIMA, NILSA DUARTE DA SILVA; GONÇALVES, RODRIGO FRANCO; DE LIMA, LUIZ ANTONIO; UNGARO, HENRY; ABE. JAIR MINORO Lameness Prediction in Broiler Chicken using a Machine Learning Technique. Information Processing in Agriculture, Vol.ume 8, Issue 3, 2021, Pages 409-418, ISSN 2214-3173, https://doi.org/10.1016/j.inpa.2020.10.003. Available in: https://www.sciencedirect.com/science/article/pii/S2214317320302092.

8. DE LIMA, L.A., ABE, J.M., MARTINEZ, A.A.G., DE FREDERICO, A.C., NAKAMATSU, K., SANTOS, J. (2020). Process and Subprocess Studies to Implement the Paraconsistent Artificial Neural Networks for Decision-Making. In: Jain, V., Patnaik, S., Popențiu Vlădicescu, F., Sethi, I. (eds) Re-cent Trends in Intelligent Computing, Communication and Devices. Advanc-es in Intelligent Systems and Computing, vol 1006. https://doi.org/10.1007/978-981-13-9406-5_61.

9. DE LIMA LA, ABE JM, MARTINEZ AAG, DE FREDERICO AC, NAKAMATSU K., SANTOS J.; Process And Subprocess Studies To Implement The Paracon-sistent Artificial Neural Networks For Decision-Making. In: Jain V., Patnaik S., Popențiu Vlădicescu F., Sethi I. (Eds) Recent Trends In Intelligent Compu-ting, Communication And Devices. Ad-vances In Intelligent Systems and Computing, Vol 1006. Springer, Singapore (2020). 2019 Print ISBN: 978-981-13-9405-8; Online Isbn: 978-981-13-9406-5; HTTPS://DOI.ORG/10.1007/978-981-13-9406-5_61

10. DE SOUZA, JONATAS S.; ABE, JAIR M: LIMA, LUIZ A. DE; SOUZA, NILSON A. DE. The General Law Principles for Protection the Personal Data and their Importance. In: 7th international conference on computer sci-ence, engineering, and information technology (cseit 2020), 2020. Comput-er science & information technology (cs & it), Copenhagen, Denmark. Anais 2020. V. 10. P. 109. HTTP://DX.DOI.ORG/10.5121/CSIT.2020.101110. (https://arxiv.org/abs/2009.14313)

11. DE SOUZA, Jonatas S. et al. The Brazilian Law on Personal Data Protec-tion. International Journal of Network Security & Its Applications (IJNSA) Vol, v. 12, 2020, Available at SSRN: https://ssrn.com/abstract=3949175

12. DORA, Manoj et al. Critical success factors influencing artificial intelli-gence adoption in food supply chains. International Journal of Production Research, p. 1-20, 2021.

13. European Commission GDPR - General Data Protection Regulation 2016 Available in: < https://gdpr-info.eu/ > Accessed on: 11/02/2022.

14. GANGI, F.; MELES, A.; MONFERRÀ, S.; MUSTILLI, M. Does corporate social respon-sibility help the survivorship of SMEs and large firms? Global Finance Journal, 43, 2020.

15. ISACA. Information Systems Audit and Control Association – COBIT 2019: Introduction and Methodology. Rolling Meadows: ISACA, 2019b.

16. LIMA, L. A. et al DPO no Brasil sob a ótica da LGPD – Lei Geral de Proteção de Dados. Instituto EXIN-Ministry of Economic Affairs in the Neth-erlands. 2020. Available in: HTTPS://WWW.EXIN.COM/BR-PT/DPO-NO-BRASIL-SOB-A-OTICA-DA-LGPD-LEI-DE-PROTECAO-DEDADOS/
17. PEC 17/2019- Proposta de Emenda à Constituição 1988. Available in: https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2210757. Accessed on: 10/02/2022.

18. RESOLUTION CD/ANPD No. 2, OF JANUARY 27, 2022. Available in: https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-2-de-27-de-janeiro-de-2022-376562019#:~:text=A%20ANPD%20poder%C3%A1%20determinar%20ao,os%20riscos%20para%20os%20titulares. Accessed on:10/02/2022;

19. ZHAO, Guoqing et al. The impact of knowledge governance mechanisms on supply chain performance: empirical evidence from the agri-food industry. Production Planning & Control, v. 32, n. 15, p. 1313-1336, 2021.