Normative Instruction BCB No. 412 of September 26, 2023

INSTRUÇÃO NORMATIVA BCB
Nº 412, DE 26 DE SETEMBRO DE 2023

Establishes the operational procedures for communication to data holders in the event of a security incident involving a database related to a component or infrastructure of Pix.

The Head of the Department of Competition and Financial Market Structure (Decem), using the powers conferred upon him by arts. 23, item I, letter “a”, 94 and 95 of the Internal Regulations of the Central Bank of Brazil, annexed to Resolution BCB No. 340, of September 21, 2023, having in view the provisions of art. 32, sole paragraph, of the Regulation annexed to Resolution BCB No. 1, of August 12, 2020,

R E S O L V E S:

Art. 1º This
Normative Instruction establishes the operational procedures for communication to holders of transactional accounts in the event of a security incident involving personal data concerning a database related to a component or infrastructure of Pix.

Art. 2º The communication referred to in art. 1º comprises the transmission of information by a Pix participant to data holders potentially affected in a security incident related to Pix confirmed by the Central Bank of Brazil.

Sole paragraph. The
Pix participant responsible for transmitting the information shall be the one holding the transactional account of the data holder potentially affected by the security incident, even if they are not responsible for the incident.

Art. 3º The Central
Bank of Brazil will request, via the Central Bank Electronic Mail System (BC Correio), that Pix participants holding transactional accounts of users potentially affected by a security incident proceed with the transmission of information to the holders.

Sole paragraph. In the message to be sent by BC Correio, the Central Bank of Brazil will provide the necessary guidelines for proper communication.

Art. 4º The Central
Bank of Brazil will identify for each Pix participant the data holders who must be notified.

§ 1º The identification referred to in the main text comprises the individual sending to each Pix participant, via the File Transfer System (STA), an APIX003 type file containing the list of Pix keys whose holders must be notified.

§ 2º The APIX003 type files corresponding to cooperatives affiliated with cooperative systems will be consolidated into a single APIX003 file that will be sent to the respective cooperative system.

§ 3º The APIX003 type files must be downloaded by users of the Pix participant accredited in the STA with the SPIX003 profile.

§ 4º The communication to data holders potentially affected must be carried out even if a Pix key eventually related in the APIX003 file is no longer linked to a transactional account maintained with the Pix Participant, provided that the relationship with the holder of the Pix key still exists.

Art. 5º The communication will be made within the timeframe defined by the Central Bank of Brazil for each event and informed in the message referred to in art. 3º, and must mention, at a minimum:

I - information regarding the incident;

II - the description of the potentially affected personal data and its nature; and

III - the risks associated with the incident.

Sole paragraph. The
Central Bank of Brazil may, at its discretion, establish other aspects to be incorporated into the communication, depending on the security incident.

Art. 6º The communication must use clear language and must be made individually and directly to the data holders, preferably through the channel habitually used by the Pix participant to communicate with the user, which is accessed by the client after proper authentication in a secure environment.

Art. 7º The Central
Bank of Brazil may request copies of the communication made to data holders potentially affected by Pix participants at any time.

Art. 8º This
Normative Instruction enters into force on the date of its publication.

Carlos
Eduardo de Andrade Brandt Silva
Head of the Department of Competition and Financial Market Structure substitute

NOTE

Decree No. 10.411, of
June 30, 2020, provides for the mandatory implementation of regulatory impact analysis (AIR) for the issuance of normative acts of general interest produced by the organs and entities of the direct and indirect federal public administration.

However, as defined in paragraph 8 of Vote 280/2021–BCB, of November 10, 2021, the Pix Regulation, including other documents that integrate, detail, or complement it, do not constitute regulatory acts of binding force, possessing, in truth, an eminently contractual nature. Thus, modifications made to the aforementioned regulation and to other documents that integrate, detail, or complement it are not subject to the prior production of AIR.

Due to the urgency of notifying data holders potentially affected by the security incident treated by Vote 140/2023-BCB, this normative instruction will enter into force on the date of its publication. Timeliness in communication is essential so that holders can adequately address the risks related to the incident.

Carlos
Eduardo de Andrade Brandt Silva
Head of the Department of Competition and Financial Market Structure substitute