Brazil: General Personal Data Protection Regulation Approved By The Senate

Digital Law

After extensive discussions in the National Congress and heated debates in the society, House of Representatives Bill of Law No. 53/2018, which regulates the processing of personal data in public and private sectors, was passed by the Senate on July 10, 2018.

The proposal approved by the Senate was accepted as House of Representatives Bill of Law No. 53/2018 after Bill of Law No. 4,060/2012, which gave rise to it, was passed by the House of Representatives on May 29, 2018. On the pretext of urgently approving such regulation in Brazil, the wording was submitted to a few formal amendments, and then approved by the Senate's Economic Affairs Commission (CAE) on July 3, 2018. Finally, in a voting held on July 10, 2018, the proposal was approved by the Senate's plenary and is now pending presidential approval to be passed into a general data protection regulation in the country.

The proposed wording seeks to create a national regulation inspired in the international guidelines, especially in those provided by the European Union's General Data Protection Regulation (GDPR), which is in force since May 25, 2018. According to the approved proposal, the processing of personal data will depend on the subject's consent, without excluding other possibilities such as legitimate interest. In addition, some conditions are established regarding sensitive data processing, as well as data from underage subjects (which will rely on parents' consent), among other relevant provisions. At last, the proposal prescribes the creation of a National Data Protection Authority, which will be tied to the Ministry of Justice to exercise certain prerogatives, such as monitoring personal data protection and even imposing sanctions, which may be up to 2% of the institution's revenue in Brazil in its last financial year, subject to a maximum limit of BRL 50,000,000.00 per infringement.

If sanctioned by the Presidency, the new regulation will be in force within 18 months after its publication, in order to provide the public and private institutions with a period of adaptation to the new legal provisions.
 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.