For companies operating in Brazil and nervously watching developments to the country's General Data Protection Law, it may have come as a bit of a relief that administrative sanctions will not be imposed until Aug. 1, 2021. It gives everyone a little time to put processes in place without fear of wrist slaps or worse, right?
The problem is there's nothing stopping immediate civil litigation under the LGPD. In fact, Brazil's Public Ministry of the Federal District and Territories filed the first lawsuit for LGPD violations Sept. 23, 2020, over the alleged sale of 500,000 citizens' personal information.
The fact that Brazil is a particularly litigious society with a judicial system already bearing the brunt of an enormous backlog of cases has privacy professionals on the ground in Brazil worried about what is to come given the LGPD's EU General Data Protection Regulation-like rights of remediation for data subjects.
"Individual and class suits are possible immediately," said Alan Campos Elias Thomaz of Alan Thomaz Advogados. "So there’s an actual possibility of enforcement by individuals, public prosecutors and consumer protection organizations even if the administrative sanctions will be enforced next year."
But compounding the problem is that, though the LGPD was accompanied by an executive order that a data protection authority be established, it only exists in name thus far. None of the posts have been filled.
"The lack of the authority really is a complicated issue because it puts more heat in the fire. The fear is that if you don’t have a DPA created soon enough, these other authorities and actors could be comfortable with enforcing the law, though not specially designed to do so," said Ana Carolina Cagnoni, CIPP/E, CIPP/US, of Grinberg Cordovil in Brazil. "And the same goes for judges; they could feel that they are the only power that could enforce the law and somehow protect the data subject, which, in the end, takes out prestige and basically authority from the DPA to be created."
She continued, "So the longer it takes for the authority to be created — and I hear this from the private sector — there is this fear of it will not have independence enough and respectability enough and power enough to play the role that the law leads for it to play. The authority will be born with less strength than it’s supposed to be, and that’s a huge concern."
Cagnoni said misinformation is also a major problem, one that could be addressed if a DPA were in place.
"Everyone was caught in surprise with this sudden date of being ready (for the LGPD to come into force)," she said. "It’s a complex law, so it’s natural for people not to be well informed."
It could lead to a whole slew of cases filed what are, essentially, a waste of time.
"What’s most of concern are wrong interpretations about the law," she said.
Adding to concerns is the tremendous backlog of cases Brazil already handles.
"The main reason is low transactional costs to file a lawsuit in Brazil," said Daniel Becker of Lima Feigelson Advogados in Brazil. "We have what we call a small claims court, a special court for civil claims, and they deal with claims with low complexity and low value. But you file the lawsuit, you don’t pay any cost, any fees, if you lose, you don’t pay anything. So everybody goes to file. You can represent yourself, you don’t need a lawyer to file a lawsuit, so a lot of people use small claims."
And that's the concern facing Brazilian courts now.
"Brazil basically allows anyone to sue anyone," Cagnoni said. "The way that I see it is that Brazil is kind of this boiling pan. Some bubbles are already coming up, but it’s that stage of many, many bubbles in the bottom of the pan right now."
It's no secret that even absent the LGPD, Brazilian courts were overwhelmed. According to this report by Wise Up News, there are more than 80 million lawsuits pending in the country, and the "amount of lawsuits in Brazil per 1,000 inhabitants is almost five times more than Germany, Sweden, Austria, and Israel. Due to this excessive judicialization, the congestion rate in the country’s courts exceeds 70 percent, causing trivial lawsuits to take years to be tried." An NPR report on the topic was called "Brazil: The land of many lawyers and very slow justice."
"Brazilians, unfortunately, have the habit of filing actions just to 'test the companies' to see if they are compliant with the laws," Monteiro said. "In case they are not, damages can be placed upon them and indemnifications can be granted to the plaintiffs."
It's reasonable to think that the country's data protection authority would play a role in disputes over the law it was born to regulate. But there again is the issue.
"Maybe our DPA can be the intermediary level, but we do not have this DPA right now," Becker said. "A lot of people are discussing this in Brazil. Without a DPA, it will be the courts that will decide how we can understand several provisions of the LGPD, which are new in Brazil, because we didn’t have a Directive of 1995 like in Europe. So the courts are going to decide what is proper consent or legitimate interest."
Becker said the change that must occur within the LGPD is for Brazilian judges to have the ability to tell claimants to try and settle their cases outside of court in arbitration.
"Otherwise, we’re going to reach 200 million cases," he said.
Thomaz predicts civil litigation claims will follow that of the country's consumer protection code, which came into force 20 years ago. It took some time, but eventually, individuals became aware they might have a legal case based on rights granted to them under the new code. Now, filing a suit under the code is practically trendy.
"People were not 100% aware of their rights, and periodically, they started to learn the rights," he said. "Now, we have a massive litigation involving the consumer relationship. I think the same will happen with data protection," albeit slowly. "Lawyers will get expertise on filing lawsuits and people will get aware of how their rights are affected. I think part of that is already happening," he added.
But if the courts are already overwhelmed, why wasn't a provision put into the law that would prevent against at least a percentage of the litigation sure to emerge?
Renato Leite Monteiro, director at Data Privacy Brasil, said there actually was such an attempt. The first version of the LGPD provided that data subject notifications would go directly to the national DPA, without requiring notification prior to the data controller.
"That changed with an amendment," he said. "Now, in order to notify the DPA, the data subject first needs to request his or her right directly with the data controller. However, the same rationale is not applied to claims filed at the judiciary, because that could be a direct violation to the right to a civil action granted by the Federal Constitution."
For now, it's a waiting game as the public slowly acclimates to new rights provided under the law and the government works to establish its DPA.
Photo by Mateus Campos Felipe on Unsplash
