An ontology that formally represents knowledge about data subject consent, according to Brazil's General Data Protection Law (LGPD). The scope covers the main concepts related to consent within the context of digital social media.
Consent Ontology in Social Media
accepted
Indicates the use or applicability of a Notice for the specified context
has notice
Indicates the use or applicability of a Notice for the specified context.
tem aviso
The DPO acts as a point of contact between the data controller, the data subjects, and the National Authority.
BRASIL. Lei nº 13.709, de 14 de agosto de 2018. Lei Geral de Proteção de Dados Pessoais (LGPD). Brasília, 2018. Available at: https://www.in.gov.br/en/web/dou/-/lei-n-13.709-de-14-de-agosto-de-2018-174008209.
acts as contact point for
canal de comunicação entre
The Data Protection Officer acts as contact point for the Data Subject and the Controller.
Indicates that a consent management system allows management by a user.
allows management by
permite gerenciamento por
A privacy dashboard allows management by the user.
Indicates that a deceptive interface attempts to influence the user's decision.
attempt to influence
tenta influenciar
A deceptive interface attempts to influence the user's decision.
Indicates that a cognitive bias or limitation can be a contributing factor leading to a vitiated consent.
can lead to
pode levar a
A cognitive bias can lead to a vitiated consent.
Indicates that the controller decides on processing of personal data.
decide sobre
decides on
The controller is someone who decides on the purposes and means of processing.
Indicates that a notice or document communicates information directly to the user.
delivers information to
entrega informação a
A privacy notice delivers information to the user about their data rights.
Indicates that a document specifies or explains data processing operations.
details processing
detalha o processamento de
A privacy policy details processing of personal data by the platform.
Relates a consent decision act (occurrent) to the legal state (disposition) it establishes.
estabelece o status
establishes status
An act of granting consent establishes a status of 'given'.
Indicates that a dark pattern leverages a specific cognitive bias or limitation to be effective.
exploits
explora
An Overloading pattern exploits the user's limited attention.
Indicates that a user expresses specific privacy preferences regarding data processing.
expressa preferência por
expresses preference for
The user expresses preference for their privacy preference to limit data sharing.
Indicates that a document regulates how a user can interact with a platform or service.
governs usage of
regula o uso de
Terms and Conditions governs the usage of a digital social media platform.
Indicates that a user has an account on a platform.
has account
tem conta
A user has account on a platform.
The DPO is appointed by the data controller and the data processor.
has appointee
tem nomeado
The Data Protection Officer has been appointed by the Controller.
Indicates that a controller appoints a Data Protection Officer.
has appointer
tem nomeante
A Controller appoints a Data Protection Officer.
Relates an agent to their cognitive capacity.
has cognitive capacity
tem capacidade cognitiva
Every natural person has cognitive capacity.
Relates a consent decision to the agent who makes it.
decisão de consentimento tomada por
has consent decision by
The consent decision is made by the data subject.
Indicates that a platform provides or makes available a document.
has document
tem documento
An online platform has a privacy policy document for its users.
A property that links an appointing process to the formal act or document that officially records and gives legal effect to that appointment.
has formal act
tem ato formal
The appointing process has formal act that confirms the appointment.
Indicates that a natural person has personal data.
tem dados pessoais
has personal data
A data subject has personal data, such as their name or email.
A relation that links a class to a specific qualifying attribute it must possess.
has quality
tem qualidade
A valid consent has quality of being informed.
A property that links a processing activity to the agent who receives the data.
has recipient
tem destinatário
A data transfer operation has a Third Party as its recipient.
A relation that links a data subject to a right they possess.
has right
tem direito
A Data Subject has the right of erasure.
Indicates that an agent assumes a specific role in the context of data processing.
has role
tem papel
A Data Processing Agent has a role of Controller.
Indicates that digital social media has users.
has user
tem usuário
An online platform has users.
Indicates that the consent is obtained through some factor such as error, fraud, coercion, injury, or state of danger.
has vitiating factor
tem fator viciante
A Vitiated Consent has vitiating factor, such as Error or Coercion.
Indicates that an online platform hosts a user account.
hospeda conta
hosts account
An online platform hosts accounts for its users.
Indicates that a platform or interface implements a specific dark pattern.
implementa padrão obscuro
implements dark pattern
A social media interface implements dark patterns to guide user choices.
Indicates that a document provides information about a specific processing activity.
informa sobre
informs about
A policy document informs about processing.
Data directly or indirectly associated or related to an individual.
is about person
é sobre uma pessoa
A piece of Personal Data is about a person.
Control mechanisms accessible on social networking platforms and sites.
está disponível em
is accessible on
A control panel is accessible on the social media platform.
Indicates that a processing activity is decided by a controller.
is decided by
é decidido por
A processing activity is decided by the Controller.
Indicates that a processing activity is described in a specific notice.
is described in notice
é descrito em aviso
The purpose of the processing is described in notice.
Indicates that a cognitive bias or limitation is leveraged by a specific dark pattern.
is exploited by
é explorado por
The user’s limited attention is exploited by an Overloading pattern.
Deliberately granted by the data subjects.
is granted by
é concedido por
A Consent Given status shows that consent is granted by the data subject.
Indicates that an account exists on or is hosted by a specific online platform.
is hosted on
é hospedada em
An online account is hosted on a specific platform.
Dark patterns are interfaces implemented on social media platforms.
is implemented on
é implementado em
A Dark Pattern is implemented on a user interface.
Indicates that a decision-making process is influenced by cognitive bias or limitation.
is influenced by
é influenciado por
A Decision Making Process is influenced by Cognitive Bias.
Relates a consent-granting act to a defect of the legal transaction that influenced it.
is influenced by defect
é influenciado por vício
An act of granting consent is influenced by a defect of the legal transaction.
A relation that links a decision to the natural person who made it.
is made by
é feita por
A decision is made by a natural person.
A relation indicating that a piece of personal data was made manifestly public by the data subject to whom it pertains.
is made manifestly public by
é tornado público por
A piece of Personal Data is made manifestly public by a Data Subject.
Relates a digital service to its operator.
is operated by
é operado por
A digital social media platform is operated by the company.
Relates a decision process (occurrent) to the data subject (continuant) who performs it.
is performed by
é realizado por
A consent decision is performed by the data subject.
Indicates that a operation is performed on personal data.
is performed on
é realizado em
A Processing activity is performed on Personal Data.
A relation indicating that a processing activity is permitted under a specific legal exemption, waiving a standard requirement such as consent.
is permitted under
é permitido sob
The processing of public data is permitted under a specific consent exemption.
Indicates that the consent has been provided by the data subject.
is provided by
é dado por
The consent is provided by the data subject.
A property that links the agent who receives the data to the processing activity.
is recipient of
é destinatário de
The state where consent has been refused by the data subject.
is refused by
é recusado por
A Consent Refused status indicates that consent has been refused by the data subject.
Indicates the cognitive capacity is restricted by limitations of cognitive capacity.
is restricted by
é restringido por
The cognitive capacity is restricted by limitations of cognitive capacity.
Indicates that the consent has been revoked by the data subject.
is revoked by
é revogado por
A Consent Withdrawn status shows that consent has been revoked by the data subject.
is right of
é direito de
The right to erasure is a right of the Data Subject.
Links a specific role to the agent that assumes it.
is role of
é papel de
A DPO is a role of a natural person.
Relates a consent status (disposition) to the decision process (occurrent) that it is a result of.
is status established by
é status estabelecido por
A status of 'given' is established by an act of granting consent.
Indicates that a legal concept is defined or established within a specific Legislation.
is stipulated in
é estipulada em
A legal Principle is stipulated in the Legislation.
Indicates that a data entity is the subject of a processing activity.
is subject of processing
é objeto de tratamento
Personal Data is subject of processing.
Indicates that an entity is affected by a bias, or limitation.
is subject to
é sujeita a
A natural person is subject to cognitive biases.
Indicates that a factor such as error, fraud, coercion, injury, or state of danger has resulted in the obtaining of vitiated consent.
is vitiating factor of
é fator viciante de
An Error is vitiating factor of a Vitiated Consent.
Legal basis used to justify processing of data or use of technology in accordance with a law.
justifica tratamento de dados
justifies processing
A Legal Basis justifies processing of personal data.
faz uma decisão
makes decision
A natural person makes a decision.
The data subject must have easy access to information about the processing of their data.
deve ser informado sobre
must be informed about
A data subject must be informed about data processing.
Activities of processing personal data shall be done in good faith and must observe the principles.
deve observar
must observe
A processing activity must observe the principles of the legislation.
Indicates that a data subject performs or is engaged in a cognitive process.
performs cognitive process
realiza processo cognitivo
A data subject performs cognitive process when making a choice.
Indicates that a control mechanism allows the user to limit access to their account.
permit limitation to
permite limitação para
A Control Mechanism permits limitation to the user's account settings.
A ‘processor’ means a natural or legal person, public authority, agency or other body which processes data on behalf of the controller.
processes on behalf of
realiza tratamento em nome de
A processor processes on behalf of a Controller.
Indicates a natural person or legal entity of either public or private law that processes personal data on behalf of the controller.
processes personal data
realiza o tratamento de dados pessoais
A processor processes personal data.
Indicates that a data subject has provided consent for processing.
fornece consentimento
provides consent
A data subject provides their consent for a specific purpose.
Indicates that a notice provides information about a specific processing activity.
fornece aviso sobre
provides notice about
A Privacy Policy provides notice about the data processing activities.
Opt-in is a process where someone is required to take an action to express explicit consent.
exige ação para o consentimento
requires action for consent
An Opt-In mechanism requires action for consent.
Processing of Personal Data requires consent.
requer hipótese legal
requires legal basis
A processing activity requires a valid Legal Basis.
Indicates that a limitation of cognitive capacity restricts the general cognitive capacity of a subject.
restricts cognitive capacity
restringe capacidade cognitiva
A limitation of Cognitive Capacity restricts the user's ability to decide rationally.
Indicates that a decision-making process results in a specific decision.
resulta em decisão
results in decision
A Decision Making Process results in a decision.
The state where the data subject revokes the consent.
revoga consentimento
revokes consent
A data subject revokes a previously given consent.
Indicates that a document or mechanism helps a user provide informed consent.
apoia o consentimento de
supports consent of
A privacy notice supports the consent of the user before data collection.
Links a status to the consent that uses it.
Is status for consent
É status para consentimento
specifies the state or status of consent
has consent status
Indicates use or applicability of a Legal Basis
has legal basis
tem hipótese legal
Indicates the status of specified concept
has status
tem status
Indicates the name (identifier) associated with this online account.
The birthday of this Agent, represented in mm-dd string form, eg. '12-31'.
The gender of this Agent (typically but not necessarily 'male' or 'female').
The specific date and time when the account was created.
Account creation date
Data de criação da conta
A unique identifier assigned to the account by the platform.
Account ID
ID da conta
The current status of the account, e.g., 'active', 'suspended', 'deleted'.
Account status
Status da conta
The date on which the given consent is set to expire.
Consent expiration
Expiração do consentimento
A textual description of the mechanism through which consent was obtained.
Consent mechanism
Mecanismo de consentimento
Classification of personal data according to the context of its use.
Categoria dos dados
Data category
A description of the source from which the data was obtained, e.g., 'User-provided form', 'Inferred from browsing activity.
Data source
Fonte dos dados
A textual description of the responsibilities of the agents.
Descreve a responsabilidade dos agentes
Describes agents' responsibility
The URL where the document can be accessed.
Document URL
URL do documento
The official contact email address for the Data Protection Officer.
DPO contact e-mail
E-mail de contato do DPO
Nome do DPO
The full name of the person appointed as the Data Protection Officer.
DPO full name
The specific date and time when consent was given by the data subject.
Has confirmation timestamp
Tem data de confirmação
A contact email address for the data processing agent.
Has contact e-mail
Tem e-mail de contato
Specifies the duration of the data processing.
Has duration
Tem duração
The date from which the policy document is effective.
Has effective date
Tem data de vigência
An email address belonging to the natural person.
Has e-mail address
Tem endereço de e-mail
Specifies the type of formal document used for an appointment, such as an administrative act or a specific contract.
has formal act type
tem tipo de ato formal
The official legal address of the data processing agent.
Has legal adress
Tem endereço oficial
The official legal name of the data processing agent.
Has legal name
Tem nome legal
A national identification number for the natural person, e.g., CPF in Brazil.
Has national ID
Tem documento nacional
A phone number belonging to the natural person.
Has phone number
Tem número de telefone
A description of the method or manner in which the data processing is carried out.
Has processing method
Tem forma de tratamento
The date on which this version of the policy document was published.
Has publication date
Tem data de publicação
The specific date and time when consent was refused by the data subject.
Has refusal timestamp
Tem data de recusamento
A detailed, specific, and explicit description of the purpose for each particular processing activity.
Has specific purpose
Tem finalidade específica
The version identifier for the policy document, e.g., 'v1.2.
Has version
Tem versão
The specific date and time when consent was withdrawn by the data subject.
Has withdrawal timestamp
Tem data de revogação
A boolean value indicating whether the data has been anonymised.
Is anonymised
É anonimizado
The date when the control mechanism was last updated or modified.
Last updated date
Última data de atualização
The specific legal citation that defines or supports this legal basis.
Citação legal
Legal citation
A textual description of what the control mechanism does and how it works.
Descrição do mecanismo
Mechanism description
A human-readable name for the control mechanism.
Mechanism name
Nome do mecanismo
A textual description of how the dark pattern is implemented and its effect.
Descrição do pattern
Pattern description
The specific location within a user interface where the dark pattern is found.
Localização do pattern
Pattern location
The commercial or official name of the online platform.
Nome da plataforma
Platform name
The primary URL for accessing the online platform.
Platform URL
URL da plataforma
A general, human-readable description of the processing activity.
Descrição do tratamento
processing description
A textual explanation for why the consent was deemed vitiated or invalid.
Explicação do vício
Vitiation reason
information content entity
Examples of information content entites include journal articles, data, graphical layouts, and graphs.
A generically dependent continuant that is about some thing.
2014-03-10: The use of "thing" is intended to be general enough to include universals and configurations (see https://groups.google.com/d/msg/information-ontology/GBxvYZCk1oc/-L6B5fSBBTQJ).
information_content_entity 'is_encoded_in' some digital_entity in obi before split (040907). information_content_entity 'is_encoded_in' some physical_document in obi before split (040907). Previous. An information content entity is a non-realizable information entity that 'is encoded in' some digital or physical entity.
PERSON: Chris Stoeckert
document
A journal article, patent application, laboratory notebook, or a book
A collection of information content entities intended to be understood together as a whole
PERSON: Lawrence Hunter
An agent (eg. person, group, software or physical artifact).
Agent
Agente
An online account.
Online Account
Conta online
A person.
Pessoa
Person
BRASIL. Comitê Central de Governança de Dados. Guia de boas práticas: Lei Geral de Proteção de Dados Pessoais (LGPD). Brasília, DF: Secretaria de Governo Digital, 2024. Available at: https://www.gov.br/governodigital/pt-br/privacidade-e-seguranca/guias/guia_lgpd.pdf.
Access
Acesso
Entering, transiting, knowing, or consulting the information.
A record of a user's credentials and profile on a system or platform, which grants them access to its services.
Account
Conta
According to Article 6, Item X of the Brazilian General Data Protection Law (LGPD - Law No. 13,709/2018).
Accountability
Responsabilização
The data processing agent must demonstrate the adoption of effective measures to ensure compliance with personal data protection regulations.
Adequacy
Adequação
Compatibility of the processing with the purposes informed to the data subject.
EUROPEAN DATA PROTECTION BOARD (EDPB). Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them. Versão final. Bruxelas, 24 fev. 2023. Available at: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_en.
Ambiguous Wording or Information
Informação ambígua
Using ambiguous and vague terms when giving information to users.
Anonymised Data
Dados anonimizados
Data related to a data subject who cannot be identified.
According to Article 5, XI, of the Brazilian Data Protection Law.
Anonimização
Anonymization
Use of reasonable technical means available at the time of processing, by which a given data loses the possibility of direct or indirect association with an individual.
An occurent that represents the process by which a Data Controller appoints a Data Protection Officer.
Appointing Process
Processo de nomeação
Brazilian Legislation
Legislação brasileira
A specific Legislation that is part of the Brazilian legal system.
Classification
Classificação
Ordering or categorizing data.
Article 151 - Braziliam civil law.
BRASIL. Lei nº 10.406, de 10 de janeiro de 2022. Institui o Código Civil. Brasília: Presidência da República, 2015. Available at: https://www.planalto.gov.br/ccivil_03/leis/2002/l10406compilada.htm.
Coercion
Coerção
Occurs when it causes the victim a fear of imminent and considerable harm to their person, family, or property.
KORTELING, J. E. (Hans); TOET, Alexander. Cognitive Biases. In: DELLA SALA, Sergio (Ed.). Reference Module in Neuroscience and Biobehavioral Psychology. Amsterdam: Elsevier, 2020. p. 610–619. Available at: https://doi.org/10.1016/B978-0-12-809324-5.24105-9.
Cognitive Bias
Viés cognitivo
Deviations in human decision making. Systematic and universally occurring tendencies, inclinations, or dispositions that skew or distort information processes in ways that make their outcome inaccurate, suboptimal or simply wrong.
KLEINSORGE, T. Cognitive capacity, representation, and instruction. Frontiers in Psychology, v. 12, art. 701687, 2021. DOI: 10.3389/fpsyg.2021.701687. Available at: https://www.frontiersin.org/journals/psychology/articles/10.3389/fpsyg.2021.701687/full.
Capacidade cognitiva
Cognitive Capacity
Refers to limits in cognitive processing and task performance that are thought to arise from limits intrinsic to an organism.
Cognitive Process
Processo cognitivo
Mental processes involved in the acquisition, processing, and utilization of knowledge or information.
Coleta
Collection
Gathering data for a specific purpose.
Communication
Comunicação
Transmitting information to data policy actions.
Conflicting Information
Informação conflitante
Giving pieces of information to users that conflict with each other in some way.
Consent
Consentimento
Data subject agrees to the processing of their personal data.
Consent Decision
Decisão de consentimento
The process/act representing a data subject's decision to grant, refuse, or withdraw consent for the processing of their personal data.
The legal concept of an exemption from the requirement of consent for processing, applicable under specific conditions defined by law, such as when data is made manifestly public by the data subject.
Consent Exemption
Consentimento dispensado
BRASIL. Lei nº 13.709, de 14 de agosto de 2018. Lei Geral de Proteção de Dados Pessoais (LGPD). Brasília, 2018. Available at: https://www.in.gov.br/en/web/dou/-/lei-n-13.709-de-14-de-agosto-de-2018-174008209
Consent Given
Consentimento dado
When the data subject agrees to the processing of personal data.
The process/act of a data subject actively granting consent.
Concessão de consentimento
Consent Granting
ALMEIDA, João; SILVA, Maria. A Blockchain-Based Hybrid Architecture for Auditable Consent Management. IEEE Transactions on Industrial Informatics, v. 19, n. 4, p. 2654–2662, 2023. DOI: 10.1109/TII.2023.10604861. Available at: https://ieeexplore.ieee.org/document/10604861.
Consent Management
Gerenciamento de consentimento
A system that allows individuals to determine what personal information they are willing to permit data processors to access.
The process/act of a data subject actively refusing consent when requested.
Consent Refusal
Recusa de consentimento
Consent Refused
Consentimento recusado
When the data subject objects to the processing of personal data.
The process/act of a data subject revoking a previously granted consent.
Consent Withdrawal
Revogação de consentimento
Consent Withdrawn
Consentimento revogado
Consent may be revoked at any time upon express request of the data subject.
ContinuousPrompting
Solicitação contínua
Overloading
Pushing users to provide more personal data than necessary for the purpose of processing or to agree with another use of their data by repeatedly asking users to provide data or to consent to a new purpose of processing.
Control
Controle
Regulating, determining, or monitoring actions on data.
ALBESHER, Abdulmohsen S.; ALHUSSAIN, Thamer. Evaluating and comparing the usability of privacy in WhatsApp, Twitter, and Snapchat. International Journal of Advanced Computer Science and Applications, v. 12, n. 8, 2021. DOI: 10.14569/IJACSA.2021.0120829. Available at: https://thesai.org/Publications/ViewPaper?Volume=12&Issue=8&Code=IJACSA&SerialNo=29.
Control Mechanism
Mecanismo de controle
Permit clients to limit who can see their profiles and filter what data or information other users or guests can see.
Controlador
Controller
Data controller
Natural person or legal entity of either public or private law in charge of making the decisions regarding the processing of personal data.
A role for an agent who makes decisions about the processing of personal data.
Controller Role
Papel de controlador
Ação de padrão manipulativo
Dark Pattern Action
Represents a process or action of manipulation within a user interface that attempts to influence a user's decisions regarding their personal data. This class distinguishes the manipulative actions from the design artifacts that enable them.
Artefato de padrão manipulativo
Dark Pattern Artifact
Deceptive Design Pattern
Deceptive pattern
Padrão obscuro
Interfaces implemented on social media platforms that attempt to influence users into making unintended, unwilling and potentially harmful decisions in favour of the social media platforms interests.
ORGANIZAÇÃO PARA COOPERAÇÃO E DESENVOLVIMENTO ECONÔMICO (OCDE). Recommendation of the Council on Enhancing Access to and Sharing of Data. Paris: OCDE, 2021. Available at: https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0463.
Dados
Data
Information
Informação
Refers to recorded information in structured or unstructured formats, including text, images, sound, and video.
The data controller and the data processor.
Agente de tratamento
Data Processing Agent
Processing Agent
Data Protection Officer
Encarregado
Protection Officer
Someone who acts as a point of contact between the data controller, the data subjects and the ANPD.
DPO
Guarantee to the data subjects of accuracy, clarity, relevance and updating of data.
Data Quality
Qualidade dos dados
Data subject
Titular dos dados
Provedor de dados
Sujeito de dados
Natural person to whom the personal data that is object of the processing refers to.
Rights of the data subject according to Article 18 of the General Data Protection Law 13.709/18.
Data Subject Right
Direito do titular
It is the legal right that each individual (data subject) has over their personal data, allowing them to control how their information is collected, processed, stored, and shared by organizations.
Beco sem saída
Dead End
While users are looking for information or a control, they end up not finding it as a redirection link is either not working or not available at all.
Conforto enganoso
Deceptive Snugness
By default, the most data invasive features and options are enabled.
Decision
Decisão
The outcome or resolution of a decision-making process.
MÜLLER, Silke M.; LIEBHERR, Magnus; WEGMANN, Elisa; BRAND, Matthias. Decision making – A neuropsychological perspective. In: Della SALA, Sergio (Ed.). Encyclopedia of Behavioral Neuroscience. 2. ed. Amsterdam: Elsevier, 2022. p. 396–403. DOI: 10.1016/B978-0-12-819641-0.00132-8. Available at: https://www.sciencedirect.com/science/article/abs/pii/B9780128196410001328?via%3Dihub.
Decision Making Process
Processo de tomada de decisão
Refers to a multistep procedure involving problem identification, solution generation and evaluation, and selection of the most suitable option.
Decontextualising
Descontextualização
A data protection information or control is located on a page that is out of context.
WOLMARANS, L.; VOORHOEVE, A. What makes personal data processing by social networking services permissible? Canadian Journal of Philosophy, v. 52, n. 1, p. 93–108, jan. 2022. DOI: 10.1017/can.2022.4. Available at: https://www.cambridge.org/core/journals/canadian-journal-of-philosophy/article/what-makes-personal-data-processing-by-social-networking-services-permissible/7D5435C95A593554009B60E2EBEAD6C0.
Default Bias
Viés do padrão
People stick with default privacy settings out of convenience or due to an implicit belief that they are protective recommendations.
According to Brazilian Civil Law.
Represents the legal factors that invalidate a legal transaction. These factors are processes that can lead to vitiated consent.
Defects of the Legal Transaction
Defeitos do negócio jurídico
GOLDER, Su; AHMED, Shahd; NORMAN, Gill; BOOTH, Andrew. Attitudes toward the ethics of research using social media: uma revisão sistemática. Journal of Medical Internet Research, v. 19, n. 6, art. e195, 2017. DOI: 10.2196/jmir.7082. Available at: https://www.jmir.org/2017/6/e195.
Digital Social Media
Mídias sociais digitais
Any Web-based computer-mediated tools to cocreate, share or exchange information, ideas, pictures or videos in virtual communities and networks.
An online account in any digital social media.
Conta em mídia social digital
Digital Social Media Account
Digital Social Media User
Usuário em mídia social digital
A data subject who holds an account and interacts with a digital social media platform.
Difusão
Dissemination
Disclosing, propagating, or multiplying data.
Distribuição
Distribution
Arranging data according to a specific criterion.
A role for an agent who acts as a point of contact between the data controller, the data subjects, and the National Authority.
DPO Role
Papel de encarregado
Elimination
Eliminação
Deleting or destroying data.
Direcionamento emocional
Emotional Steering
Influencing the emotional state of users in such a way is likely to lead them to make an action that works against their data protection interests.
Article 138 - Braziliam civil law.
When the declarations of intent result from a substantial error.
Erro
Error
Avaliação
Evaluation
Analyzing data to produce information.
Extraction
Extração
Copying or removing data from its original location.
Fickle
Inconsistência
Design of the interface is inconsistent and not clear.
Arquivamento
Filing
Keeping a record of data at any stage.
ASSOCIAÇÃO NACIONAL DE PROTEÇÃO DE DADOS (ANPD). Resolução CD/ANPD nº 18, de 16 de julho de 2024. Aprova o Regulamento sobre a atuação do encarregado pelo tratamento de dados pessoais. Diário Oficial da União, Brasília, DF, ed. 136, p. 1-4, 18 jul. 2024. Available at: https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-18-de-16-de-julho-de-2024-572632074.
Ato formal de nomeação
Formal Act Of Appointment
Represents a formal, written document used to indicate a data processing agent's explicit intention to appoint an individual or legal entity as the Data Protection Officer.
Malicious conduct carried out with the aim of leading the other party to a mistake about the actual circumstances of the transaction.
GUERRA, Alexandre Dartanhan de Mello (coord.); MARTINS, Ricardo Marcondes (et al.). Estudos em homenagem a Clóvis Beviláqua por ocasião do centenário do Direito Civil codificado no Brasil, 1. São Paulo: Escola Paulista da Magistratura, 2018. Livro. (v). ISBN 9788590679011. Available at: https://biblioteca.sophia.com.br/terminal/9549/acervo/detalhe/51489.
Dolo
Fraud
Guarantee to the data subjects of facilitated and free of charge consultation on the form and duration of the processing.
Free Access
Livre acesso
Free Bias
Viés de gratuidade
Consumers underweight the nonmonetary costs of acquiring goods or services with a zero monetary price.
DROZD, O.; KIRRANE, S. A conceptual consent request framework for mobile devices. Information, v. 14, n. 9, p. 515, 2023. DOI: https://doi.org/10.3390/info14090515. Available at: https://www.mdpi.com/2078-2489/14/9/515.
Consentimento livre
Free Consent
Provide real choice to the data subjects
The practice of the duty of respect, fairness, transparency, and loyalty in all legal relationships.
ROSA, Marina da Silva. Boa-fé e probidade. In: ENCICLOPÉDIA JURÍDICA DA PUC/SP. São Paulo: PUC-SP, 2021. Available at: https://enciclopediajuridica.pucsp.br/verbete/597/edicao-3/boa-fe-e-probidade.
Boa-Fé
Good Faith
LUGATI, Lys Nunes; ALMEIDA, Juliana Evangelista de. Da evolução das legislações sobre proteção de dados: a necessidade de reavaliação do papel do consentimento como garantidor da autodeterminação informativa. Revista de Direito, Viçosa, v. 12, n. 2, p. 1–33, 2020. Available at: https://periodicos.ufv.br/revistadir/article/view/10597.
Consentimento granular
Granular Consent
Consent given in a segmented manner, at each stage of data flow and for each attempt to access personal data.
Consent given in a segmented manner.
Consentimento granular dado
Granular Consent Given
Escondido à vista de todos
Hidden in Plain Sight
Stirring
Use a visual style or technique for information or data protection controls that nudges users toward less restrictive and thus more invasive options.
SEILING, L.; GSENGER, R.; MULUGETA, F.; HENNINGSEN, M.; MISCHAU, L.; SCHIRMBECK, M. Beware: processing of personal data—informed consent through risk communication. IEEE Transactions on Professional Communication, v. 67, n. 1, p. 4-25, mar. 2024. DOI: 10.1109/TPC.2024.3361328. Available at: https://ieeexplore.ieee.org/document/10472565.
Desconto hiperbólico
Hyperbolic Discounting
The overestimation of immediate consequences and discount of future consequences.
Inconsistent Interface
Interface inconsistente
An interface is not consistent across different contexts or with users’ expectations.
VAN OOIJEN, I.; VRABEC, H. U. Does the GDPR enhance consumers’ control over personal data? An analysis from a behavioural perspective. Journal of Consumer Policy, v. 42, p. 91–107, 2019. DOI: 10.1007/s10603-018-9399-7. Available at: https://link.springer.com/article/10.1007/s10603-018-9399-7. Acesso em: 03 maio 2025.
Complexidade de informação
Information Complexity
The difficulty individuals face in understanding privacy-related information due to varying levels of literacy and the intricate nature of data policies.
VAN OOIJEN, I.; VRABEC, H. U. Does the GDPR enhance consumers’ control over personal data? An analysis from a behavioural perspective. Journal of Consumer Policy, v. 42, p. 91–107, 2019. DOI: 10.1007/s10603-018-9399-7. Available at: https://link.springer.com/article/10.1007/s10603-018-9399-7.
Information Overload
Sobrecarga de informação
When individuals are confronted with large amounts of complex and dispersed data, making it difficult for them to process, filter, and make informed decisions.
KURTEVA, Anelia; CHHETRI, Tek Raj; PANDIT, Harshvardhan J.; FENSEL, Anna. Consent through the lens of semantics: state of the art survey and best practices. Semantic Web, [s.l.], p. 1–27, 2021. Available at: https://doi.org/10.3233/SW-210438.
Consentimento informado
Informed Consent
Requires provision of relevant information prior to consent.
Article 157 - Brazilian civil law.
Injury
Lesão
When someone is obliged to a performance that is manifestly disproportionate to the value of the counter-performance.
Hierarquia ausente
Lacking Hierarchy
Information related to data protection lacks hierarchy, making information appear several times and being presented in several ways.
Descontinuidade de linguagem
Language Discontinuity
Information related to data protection is not provided in the official language(s) of the country where users live, whereas the service is.
Deixar no escuro
Left In The Dark
The interface is designed to hide information or data protection tools.
Hipótese legal
Legal Basis
A justification or lawful ground, stipulated by legislation, that permits the processing of personal data.
Legal basis used to justify data processing or the use of technology in accordance with the LGPD.
BRASIL. Lei nº 13.709, de 14 de agosto de 2018. Lei Geral de Proteção de Dados Pessoais (LGPD). Brasília, 2018. Disponível em: https://www.in.gov.br/en/web/dou/-/lei-n-13.709-de-14-de-agosto-de-2018-174008209. Acesso em: 6 fev. 2025.
Base legal segundo LGPD
Legal Basis under LGPD
Hipótese legal segundo LGPD
CAMARA DOS DEPUTADOS. Pessoa jurídica. Available at: https://www2.camara.leg.br/a-camara/estruturaadm/gestao-na-camara-dos-deputados/responsabilidade-social-e-ambiental/acessibilidade/glossarios/dicionario-de-libras/p/pessoa-juridica
Legal Entity
Pessoa jurídica
Entity constituted by individuals and recognized by the government as holder of rights and duties.
Legislation
Legislação
Rules or laws relating to a particular activity that are made by a government.
The agent must prove the effectiveness of the measures in achieving compliance with personal data protection regulations.
Liability
Prestação de contas
People have limitation of cognitive capacity that influence their rational decision and these limitations complicate the balanced benefit and risk assessment necessary for accurate decision-making processes.
Limitation of Cognitive Capacity
Limitação da capacidade cognitiva
Longer Than Necessary
Mais longo que o necessário
When users try to activate a control related to data protection, the user journey is made in a way that requires more steps from users, than the number of steps necessary for the activation of data invasive options.
Look Over There
Olhe para lá
A data protection related action or information is put in competition with another element which can either be related to data protection or not.
Ação enganosa
Misleading Action
A discrepancy between information and actions available to users nudges them to do something they do not intend to.
Modification
Modificação
Altering data.
Autoridade nacional
National authority
Body of the public administration responsible for ensuring, implementing and supervising compliance with the data protection law in all national territory.
Begins at birth with life and ends with death.
BRASIL. Lei nº 10.406, de 10 de janeiro de 2022. Institui o Código Civil. Brasília: Presidência da República, 2015. Available at: https://www.planalto.gov.br/ccivil_03/leis/2002/l10406compilada.htm
Natural Person
Pessoa natural
Limitation of the processing to the minimum required for the accomplishment of its purposes.
Necessidade
Necessity
Impossibility of carrying out the processing for unlawful or abusive discriminatory purposes.
Non-Discrimination
Não discriminação
Dados não-pessoais
Data that is not personal.
Non Personal Data
Personal data that is not sensitive.
Dados pessoais não sensíveis
Non Sensitive Personal Data
General personal data
Consent is considered null if the information provided to the data subject is misleading or abusive, or if it was not presented transparently, clearly, and unambiguously beforehand.
Consentimento nulo
Null Consent
Obstructing
Obstrução
Hindering or blocking users in their process of becoming informed or managing their data by making the action hard or impossible to achieve.
Online Platform
Plataforma online
A digital service or environment that facilitates interactions between users or between users and the service provider.
ASSOCIAÇÃO BRASILEIRA DE NORMAS TÉCNICAS - ABNT. NBR ISO/IEC 29100:2024 - Tecnologia da informação - Técnicas de segurança - Arquitetura de privacidade. Rio de Janeiro, 2024.
Opt-In
Opt-in
Process or type of policy whereby the personally identifiable information principal is required to take an action to express explicit consent.
Opt-out
A process or type of policy whereby the personally identifiable information is required to take a separate action in order to withhold or withdraw consent, or oppose a specific type of processing.
Sobrecarga
Large quantity of requests, information, options or possibilities.
Dados pessoais
Personal Data
Information regarding an identified or identifiable natural person.
Operador de plataforma
Platform Operator
A legal entity, such as an organization or company, that is responsible for the administration and operation of an online platform.
A formal document that outlines the principles, rules, and guidelines an organization adheres to in a specific area, such as a privacy policy.
Documento de política
Policy Document
Present Bias
Viés do presente
When considering the trade-off between well-being at the current moment and well-being at a later time, a person places more importance on their well-being in the present compared to how they would assess this trade-off at other times.
Adoption of measures to prevent the occurrence of damages due to the processing of personal data.
Prevention
Prevenção
BRASIL. Senado Federal. Princípios jurídicos. Brasília: Subsecretaria de Edições Técnicas, 2001. (Texto para Discussão, n. 160). Available at: https://www2.senado.leg.br/bdsf/bitstream/handle/id/918/R160-19.pdf.
Principle
Princípio
Primary and fundamental legal mandates.
According to Article 6 of the Brazilian General Data Protection Law (LGPD - Law No. 13,709/2018).
Principle under LGPD
Princípio conforme LGPD
Labirinto de privacidade
Privacy Maze
When users wish to obtain certain information or use a specific control or exercise a data subject right, it is particularly difficult for them to find it as they have to navigate through too many pages in order to obtain the relevant information or control.
ROBOL, Marco; BREAUX, Travis D.; PAJA, Elda; GIORGINI, Paolo. Consent verification monitoring. ACM Transactions on Software Engineering and Methodology, v. 32, n. 1, art. 4, 29 jun. 2022. Available at: https://doi.org/10.1145/3490754.
Aviso de privacidade
Privacy Notice
Represents a notice or document outlining information regarding privacy.
ROBOL, Marco; BREAUX, Travis D.; PAJA, Elda; GIORGINI, Paolo. Consent verification monitoring. ACM Transactions on Software Engineering and Methodology (TOSEM), v. 32, n. 1, 2022. DOI: 10.1145/3490754.
Política de Privacidade
Privacy Policy
A legal document organizations use to communicate their policy and practices to data subjects and users.
Specific choices made by a personally identifiable information principal about how their information should be processed for a particular purpose.
Preferência de privacidade
Privacy Preference
Pessoa jurídica de direito privado
Private Legal Entity
A legal entity governed by private law, typically established for private interests.
Processing
Tratamento
Any operation performed on personal data.
Processing Based on Consent
Tratamento com base no consentimento
A type of processing that is legally justified by a valid, given consent from the data subject.
Processing of Public Data
Tratamento de dados públicos
A type of processing performed on personal data that has been made manifestly public by the data subject, which may operate under a consent exemption.
EUROPEAN DATA PROTECTION BOARD (EDPB). Available at: https://www.edpb.europa.eu/sme-data-protection-guide/faq-frequently-asked-questions/answer/what-does-processing-personal-data_en
Operação de tratamento de dados
Processing Operation
Any type of activity performed on or with individuals’ personal data.
Operador
Processor
Natural person or legal entity of either public or private law that processes personal data on behalf of the controller.
A role for an agent who processes personal data on behalf of a controller.
Papel de operador
Processor Role
Production
Produção
Creating goods and services based on data processing.
RODRIGUES, Anna Luísa Braz. Os termos de uso do “Grindr” e a proteção de dados pessoais como direito de personalidade: a vulnerabilidade de usuários LGBTQIAPN+ em aplicativos de relacionamentos amorosos e sexuais. Revista do CAAP, Belo Horizonte, v. 29, n. 1, p. 1–26, 2024. Available at: https://doi.org/10.69881/rcaap.v29i1.52360.
Perfilização
Profiling
Perfilamento
Evaluate certain aspects related to a person, through an automated process of personal data processing.
Pessoa jurídica de direito público
Public Legal Entity
A legal entity that is part of the direct or indirect public administration.
Personal data that has been made manifestly public by the data subject, as described in Art. 7, § 4º of the LGPD.
Dados pessoais tornados públicos
Publicly Manifested Personal Data
Processing for legitimate, specific and explicit purposes of which the data subject is informed.
Finalidade
Purpose
RICOU, M.; MARINA, S. Decision making and ethical reasoning in psychology. Psychology in Russia: State of the Art, v. 13, n. 1, p. 2–10, 2020. DOI: 10.11621/pir.2020.0101. Available at: https://psychologyinrussia.com/volumes/?article=8359.
Decisão racional
Rational Decision
A decision based on a hypothetical-deductive model after all the necessary information has been obtained.
Recepção
Receiving data at the end of a transmission.
Reception
Reproduction
Reprodução
Copying pre-existing data.
Direito
Right
A power or privilege held by the general public, usually as the result of a constitution, statute, regulation, or judicial precedent. Legal rights are enforceable by legal institutions and can be invoked in courts of law.
Direito à portabilidade dos dados
Right of Data Portability
The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.
Direito à eliminação
Right of Erasure
The data subject has the right to obtain erasure of their personal data.
Direito ao acesso aos dados
Right to Access Personal Data
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data along with additional information about it.
Direito à anonimização
Right to Anonymization
The data subject has the right to data anonymization.
Direito a confirmação
Right to Confirmation
The data subject has the right to confirmation of the existence of processing.
Direito à informação sobre o tratamento
Right to Information About Processing
The right to basic information about processing provides data subjects with information about the processing activities involving their personal data.
Direito de opor-se ao tratamento
Right to Object to Processing
The data subject has the right to object to processing of their personal data.
Direito à proteção de dados pessoais
Right to Personal Data Protection
The right to the protection of personal data is ensured, including in digital media, as a fundamental right, according to Article 5, LXXIX, of the Federal Constitution.
Direito à correção
Right to Rectification
The data subject has a right to rectify their personal data.
Direito ao bloqueio
Right to Restrict Processing
The data subject has the right to restrict the processing of their personal data.
Direito à revogação
Right to Withdrawal
The data subject has the right to withdraw consent.
Use of technical and administrative measures able to protect personal data from unauthorized accesses and accidental or unlawful events of destruction, loss, alteration, communication or dissemination.
Security
Segurança
religious, philosophical or political organization affiliation
Dados pessoais sensíveis
Sensitive Personal Data
Personal data concerning racial or ethnic origin, religious belief, political opinion, affiliation to trade unions or to a religious, philosophical or political organization, data regarding health or sex life, genetic or biometric data, when related to a natural person.
Omissão
Skipping
Designing the interface in a way that users forget or do not think about the data protection aspects.
Article 156 - Brazilian civil law.
When someone, pressed by the need to save themselves or a family member from serious harm, assumes an excessively burdensome obligation.
Estado de perigo
State of Danger
Manipulação emocional
Affects the choice by appealing to their emotions or using visual nudges.
Armazenamento
Storage
Keeping or preserving data in a repository.
Termos e condições de uso
Terms and Conditions
Terms and Conditions of usage as provided to the user in agreement of provided service.
Someone who is not a party to a dispute or agreement.
CORNELL LAW SCHOOL. Third party. Legal Information Institute, [s.d.]. Available at: https://www.law.cornell.edu/wex/third_party.
Terceiro
Third Party
Excesso de opções
Too Many Options
Providing users with (too) many options to choose from.
Transfer
Transferência
Moving data from one storage area to another.
Transmission
Transmissão
Moving data between two points.
Guarantee to the data subjects of clear, accurate and easily accessible information on processing activities and the respective processing agents.
Transparency
Transparência
Consentimento inequívoco
Unequivocal Consent
Consentimento explícito
Consentimento expresso
Deliberately granted by the data subjects
Usage
Utilização
Act or effect of utilizing data.
When consent is obtained through error, fraud, coercion, injury, or state of danger
LUGATI, L. N.; ALMEIDA, J. E. de. Da evolução das legislações sobre proteção de dados: a necessidade de reavaliação do papel do consentimento como garantidor da autodeterminação informativa. Revista de Direito, [S. l.], v. 12, n. 02, p. 01–33, 2020. DOI: 10.32361/2020120210597. Available at: https://periodicos.ufv.br/revistadir/article/view/10597.
Vitiated Consent
Vício do consentimento
Represents consent states that are invalid for processing.
Status inválido para tratamento
Status Invalid for Processing
Represents consent states that are valid for processing
Status válido para tratamento
Status Valid for Processing
Consentimento invalidado
The state where consent has been deemed to be invalid
Consent Invalidated
An example of this state is where an investigating authority or a court finds the collected consent did not meet requirements, and 'invalidates' both prior and future uses of it to carry out processing
Status do consentimento
The state or status of 'consent' that provides information reflecting its operational status and validity for processing data
Consent Status
States are useful as information artefacts to implement them in controlling processing, and to reflect the process and flow of obtaining and maintaining consent. For example, a database table that stores consent states for specific processing and can be queried to obtain them in an efficient manner. States are also useful in investigations to determine the use and validity of consenting practices
Agência Nacional de Proteção de Dados
Brazilian Civil Code, law no. 10,406/2002
Brazilian Civil Code
Código Civil
Brazilian General Data Protection Law, law no. 13,709/2018.
Brazilian General Data Protection Law
Lei Geral de Proteção de Dados Pessoais