In less than 48 hours, privacy professionals in Brazil and around the world have seen significant developments and unique challenges regarding the country's data protection legal landscape and, in particular, Brazil’s General Data Protection Law.
On Aug. 25, 2020, the Brazilian House of Representatives approved Provisional Measure (MP) No. 959/2020, which included text stating the LGPD would enter into force Dec. 31, 2020. This outcome was celebrated by several local players, particularly in the technology sector, who were happy with the possibility of adding a few extra months to their implementation and compliance programs.
However, on Aug. 26, the Brazilian Senate approved Conversion Bill (PLV) 34/2020, which originated from MP No. 959/2020, that was approved by the House of Representatives just a day earlier. But due to a “question of order” raised by one of the senators, Article 4 of the MP, which would postpone the LGPD entering into force, was removed from the legal text by the Brazilian Senate.
For a few hours, with no decision in sight regarding Brazil’s data protection authority and no possibility for a rediscussion of the removed text, privacy professionals were under the impression the LGPD's entry into force date would change to Aug. 16, as stated in the current text of the law.
But on Aug. 27, just a few hours after the Senate decision Wednesday, the Brazilian federal government published Decree No. 10,474/2020, which approved the regulatory structure of the Autoridade Nacional de Proteção de Dados, as created and provided for in the LGPD. Under the decree, the ANPD will be linked to the Presidential Office and endowed with technical and decision-making autonomy but will have limited independence. The ANPD Directing Council will be composed of five members directly appointed by the chief of staff of the presidency and only after scrutiny and an interview process conducted by the Senate.
In this scenario, the exact starting term of the LGPD depends on when Brazilian President Jair Bolsonaro sanctions the PLV, which could occur within the next 15 days. And the existence of the ANPD becomes a matter of properly nominating the members of the Directing Council.
The publication of the decree is, in our view, a strong indicator that we are at a “point of no return” regarding the LGPD now that the Brazilian government might be committed to launching the ANPD. This move is viewed positively by Brazilian privacy professionals, as it reduces the uncertainties about the validity of LGPD and validates the creation of the much-needed DPA that is responsible for the inspection and regulation activities of its provisions.
Some risks still remain. Although sanctions involving the LGPD have already been postponed until August 2021, consumer protection authorities, civil society groups and public prosecutors could still initiate legal proceedings against Brazilian and foreign companies based on privacy issues. With no established DPA, these parties might want to enforce the LGPD, with claims for damages and indemnifications instead of the fines and sanctions that would be the responsibility of the forthcoming ANPD.
With all these issues on the table and a “fast track” of relevant developments, anyone who confidently tells you that they fully understand this “LGPD confusion” and know the next steps are either based on their own interpretation of the facts or is just guessing based on instinct.
In view of the current moment, companies should consider their activities of adaptation and implementation of LGPD as a priority. Increasing the pace or tackling urgent issues might guarantee an adequate level of compliance with the LGPD, as well as best practices that are now under development in several specific sectors, such as education, advertising and technology.
For the local privacy practitioner, this is a unique moment. It is very difficult to see and even enjoy the actual “birth” of a whole new legal practice in Brazil. With almost two years of delays and expectations, it is good to see how things moved really fast and not smoothly. These are exciting times to work with privacy in Brazil, if you consider the number of opportunities that may be around in the next few months and years.
And regarding the ANPD, we can only hope that this new authority is open to debate and cooperation with the privacy community, private sector and different professional organizations.
Photo by Isabela Kronemberger on Unsplash
