O caso Klara Castanho e a proteção de dados na saúde suplementar: uma análise crítica sob a luz do ordenamento jurídico e regulatório brasileiro e do compliance como ferramenta de privacidade

Abstract

This paper proposed a study on how compliance can be used as a strategic tool to prevent data breaches in the supplementary health sector, using the data leak involving actress Klara Castanho as a case study. To this end, it analyzed the Brazilian regulatory framework for data protection and the regulations specific to the supplementary health sector, with a focus on the General Data Protection Law (LGPD), the Normative Resolutions of the National Supplementary Health Agency (ANS), and related legislation. The methodology adopted included bibliographic, documentary, and jurisprudential research. The results showed that the implementation of structured compliance programs — including data flow mapping, the preparation of Data Protection Impact Reports (DPIA), and ongoing employee training — constitutes an essential mechanism for regulatory compliance. The case under analysis also highlighted the need for coordination between administrative (ANPD and ANS), civil, and ethical-professional (Professional Councils) spheres to ensure accountability for those involved in similar incidents and to guarantee justice for the victim. However, when examining the specific case of the actress, the actions of the authorities showed to be ineffective, failing to impose appropriate sanctions and to protect Klara's fundamental rights.