The Ministry of Justice, through the National Consumer's Office ("SENACON"), submitted a new version of the Draft Bill on Data Protection ("Draft Bill") during the international seminar Brazilian Draft Bill of Law on Personal Data Protection from a Comparative Perspective.
Hundreds of contributions from the public and private sectors and NGOs were analyzed in order to achieve this recent version of the Draft Bill, which was prepared jointly by the SENACON and the Office of Legislative Affairs of the Ministry of Justice.
The Draft Bill, if compared with the bill released last January, can be considered more detailed; it essentially seeks to protect personal data processing in order to guarantee the free development of the individual's personality and dignity. Below, you will find a brief summary of the main aspects of the Draft Bill.
Definition of Personal Data
The Draft Bill defines personal data as any type of data capable of identifying an individual, including I.D. numbers, data as to location and electronic identifiers, the latter being restricted to those relating to an identified person. The first version of the text did not present this restriction.
Data Anonymization
The concept of data anonymization was introduced by the Draft Bill. Where the process by which data is made anonymous is reversed or can be reversed upon reasonable effort, such data will be considered personal data and therefore will be covered by the Draft Bill.
Requirements for Treatment of Personal Data
Although both the old version and the recently issued Draft Bill, stipulate the necessity of obtaining the data subjects' consent for the use of their personal data, the new version of the Draft Bill requires, as a general rule, "free and unambiguous" consent. Under the Draft Bill, express consent is only required in specific situations, such as processing of sensitive data.
International Transfer of Data
The international transfer of data is permitted between countries that have personal data protection that is similar to the protection stipulated in the Draft Bill and also in specific circumstances, such as to protect the individual's life or physical well-being, or when the data subject consents to the transfer after previously being specifically informed as to the international nature of the data processing and its risks.
National Council for Data and Privacy Protection
Another important change in the Draft Bill, which was introduced after public hearings, was the creation of the National Council for Data and Privacy Protection. This Council is responsible for the implementation and supervision of the Draft Bill. It will assist relevant agencies to guarantee the effectiveness of the data protection rights of individuals.
Pursuant to the Draft Bill, relevant agencies are required to: (i) ensure the protection of personal data; (ii) apply administrative sanctions for non-compliance with regulations; (iii) issue guidelines for compliance with the national personal data and privacy policy; and (iv) regulate data protection and privacy.
According to representatives from SENACON, the Draft Bill will be sent directly to the President's Chief of Staff for approval before beginning its legislative process. Please note that on October 13, 2015, the Senate's Technology and Science Commission approved an alternate text to Bill Nº 330/2013, which is a combination of other proposals submitted to the Senate involving data protection (i.e., Draft Bills N° 131/2014 and 181/2014). However, the alternate text must still be debated by other commissions.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
