The "Brazilian General Data Protection Law" (Law No. 13709/2018), or "LGPD," has generated much doubt and uncertainty since its enactment on August, 14, 2018, because some of its provisions were already in force, while others were not, leaving many to ask, "What has happened since the law's enactment?"
Some background: Initially, the LGPD was expected to be fully in force in February 2020. Meeting this deadline was considered important in order to allow sufficient time for companies and other public entities to adapt to the LGPD and for the National Authority for Protection of Data ("ANPD"), an authority being created to regulate, inspect and create guidelines, to plan for regulating and enforcing the LGPD. Subsequently, Provisional Measure ("PM") 869/18 extended the entry into force to August 2020, and later, due to the COVID-19 outbreak, PM 959/20 was published in the Official Gazette of the Federal Executive, postponing LGPD's effectiveness to May 2021.
On August 25, just one day before it was set to expire, PM 959/20 was put to a vote by the House of Representatives, and the LGPD was approved to come into force even earlier, on December 31, 2020. Soon after, it was sent to the Senate, which, in turn, went against the House of Representatives, considering that Article 4 of the PM 959/20 was aggrieved. From then on, the period of 15 working days for the LGPD to come into force would be extended, regardless of President Jair Bolsonaro's sanction or veto. As expected, the president sanctioned the bill, arising from the altered PM 959, on Thursday, September 17, 2020. This means that the normative structure of the LGPD is now fully enforceable, with the exception of the administrative sanctions, which are provided for in articles 52, 53 and 54 and will come into force in August 2021, by way of Law 14.010/20.
Regarding the creation of the ANPD, the government published in
the Official Gazette dated August 27, 2020, Decree No. 10.474/20,
which approves the ANPD's organizational structure. Although
articles 55A, 55L, 58A and 58B of the LGPD have been in force since
2018, a structure to organize the authority had not been disclosed,
which is of utmost importance for the start of ANPD activities.
Therefore, in addition to other provisions, 36 commissioned and
trust positions were created, which will be filled in the coming
months; to date, there have been no appointments.
However, despite the progress made in defining the organization of the ANPD, its regulatory role still needs to be determined. Consequently, we will have a law in force with interpretive gaps to be filled by the ANPD, which is not yet fully structured to exercise its primary function of guiding and implementing the LGPD. The lack of guidelines means that entities will have to interpret the rules on their own, which could lead to conflicts that will have to be handled in the Courts of Justice.
In this current scenario, companies must adapt to the norms foreseen in the LGPD.
Although we do not know when the ANPD will actually be formed and operational, the effectiveness of the LGPD makes its obligations entirely enforceable, except by the administrative sanctions which were postponed to August, 2021. Consequently, it is extremely important that companies become compliant with the law as soon as possible because entities such as PROCON, the Public Prosecutor's Office, the National Consumer Secretariat, State Secretariats and Class Entities can take charge of monitoring compliance with the LGPD, and, in addition to judicially seeking corporate liability for breaching the LGPD, they may also apply sanctions based on other laws such as the Brazilian Internet Law Framework (Marco Civil da Internet) and the Code of Consumer Defense and Protection (Código de Defesa do Consumidor).
Visit us at Tauil & Chequer
Founded in 2001, Tauil & Chequer Advogados is a full service law firm with approximately 90 lawyers and offices in Rio de Janeiro, São Paulo and Vitória. T&C represents local and international businesses on their domestic and cross-border activities and offers clients the full range of legal services including: corporate and M&A; debt and equity capital markets; banking and finance; employment and benefits; environmental; intellectual property; litigation and dispute resolution; restructuring, bankruptcy and insolvency; tax; and real estate. The firm has a particularly strong and longstanding presence in the energy, oil and gas and infrastructure industries as well as with pension and investment funds. In December 2009, T&C entered into an agreement to operate in association with Mayer Brown LLP and become "Tauil & Chequer Advogados in association with Mayer Brown LLP."
© Copyright 2020. Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. All rights reserved.
This article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.