The Brazilian General Data Protection Law (“LGPD”), inspired by the European regulation on the matter, was enacted in August 2018, under Nr 13,709/18, and imposes additional obligations on the treatment of personal data.
The LGPD must be complied by all companies that offer services or have operations involving data handling in Brazil.
Companies that violate the new law will be subject to the application of administrative penalties by the Brazilian Data Protection Authority (“DPA”): warnings, fines and partial or total suspensions of their activities. Fines can reach up to 2% of the organization’s revenue, with a limit of R$50 million per violation.
There are 3 different moments to LGPD’ Articles entering into force:
- The creation of a DPA was authorized by Law Nr. 13,853/19 to enter into force as of December 28th, 2018.
- The imposition of administrative penalties by DPA: pursuant to Law Nr. 14,010/20, it may only occur as from August 1st, 2021.
- Other Articles from LGPD: on August 26th, 2020, the Brazilian Senate partially rejected the Provisional Measure Nr 959/20, in the part that postponed to May 3rd, 2021, the date that certain LGPD Articles would enter into force. In accordance with the Federal Constitution, this decision is now subject to be vetoed or sanctioned by the Brazilian President. Therefore, the process is very advanced and all other Articles from LGPD (except administrative penalties applied by DPA) may enter into force during the next few days.
It is important to highlight that civil (including consumer), labor, regulatory and even electoral claims may be presented in case of sanction by the Brazilian President of the decision that partially rejected Provisional Measure Nr 959/20, since in such case all principles and legal basis to treat personal data will enter in full force.
Further, despite of Law Nr 13,853/19, the DPA was not yet organized. Nevertheless, the Brazilian President enacted on August 26th, 2020 the Decree Nr. 10,474/20 contemplating the structure and all other rules regarding the organization of the DPA (positions, functions, amongst others). We expect that the DPA will be functioning soon.
The technology and data protection team of Schmidt, Valois, Miranda, Ferreira & Agel has been following closely the LGPD entering into force process and is at your disposal to assist you in adopting necessary measures to be in compliance with all data protection obligations.