Breaking news: the Brazilian President Michel Temer issued yesterday and had published today the so-called "Provisory Measure" No. 869/2018 (Medida Provisória, a norm issued by the President alone, usually reserved for urgent and relevant matters) to amend the New Brazilian Data Privacy Law (Lei Geral de Proteção de Dados, "LGPD"). With this measure, the President created a National Data Protection Authority and determined that the LGPD shall enter into force 24 months – and not 18 months as the LGPD initially established – after its publication, which took place on 15 August 2018 (amendment to article 65 of the LGPD by the Provisory Measure).
Companies now have until 16 August 2020 to become compliant with the LGPD – indeed a nice late Christmas present, considering the huge impact the new legislation will have on any company processing personal data of Brazilian individuals – that is, practically all Brazilian companies and a number of foreign companies doing business in Brazil. The LGPD is strongly based on the General Data Protection Regulation ("GDPR") which entered into force on 25 May 2018 in Europe, and represents quite a revolution in the field of data protection in the Brazilian legal system, which so far consists of very sparse provisions.
National Data Protection Authority
According to the Provisory Measure, the National Data Protection Authority is an organ of the federal public administration, integrating the Executive. Articles 55-A to 55-K, 58-A and 58-B of the Provisory Measure No. 869/2018 contain detailed provisions regarding its composition, the mandate of its members and its attributions. The statutes of the authority shall be established by the President in a separate act.
A poisoned gift? It is true that the authority is the one competent to issue fines and take other enforcement actions. On the other hand, the European experience shows that data protection authorities have a very important role in providing clarity and guidance as to the interpretation of data protection provisions and how to implement them in practice. Perhaps this will be the same in Brazil.
The Provisory Measure shall now be appreciated by Legislative organs within 45 days. It is valid for 60 days, but its validity may be extended by another 60 days. Under certain circumstances a Provisory Measure may be reedited by the President. Issues regarding the (apparently inexistent) financial and administrative autonomy of the authority, as well as how it will function concretely, are still open and will certainly be the topic of discussions and criticism in the coming weeks and months.
Visit us at Tauil & Chequer
Founded in 2001, Tauil & Chequer Advogados is a full service law firm with approximately 90 lawyers and offices in Rio de Janeiro, São Paulo and Vitória. T&C represents local and international businesses on their domestic and cross-border activities and offers clients the full range of legal services including: corporate and M&A; debt and equity capital markets; banking and finance; employment and benefits; environmental; intellectual property; litigation and dispute resolution; restructuring, bankruptcy and insolvency; tax; and real estate. The firm has a particularly strong and longstanding presence in the energy, oil and gas and infrastructure industries as well as with pension and investment funds. In December 2009, T&C entered into an agreement to operate in association with Mayer Brown LLP and become "Tauil & Chequer Advogados in association with Mayer Brown LLP."
© Copyright 2018. Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. All rights reserved.
This article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.