Brazilian General Data Protection Law updates: effectiveness and ANPD structure
After some back and forth, Brazil has seen relevant legislative developments over the last days regarding the effectiveness of the Brazilian General Data Protection Law (Law 13.709/2018 – the “LGPD”) and the definition of the structure and regulatory framework of the National Data Protection Authority (the “ANPD”).
The LGPD was enacted in 2018, with delayed effects. Some LGPD provisions are already effective, while others have yet to come into force. In the last week of August, the open points regarding the different effective dates of the LGPD provisions were finally determined, as indicated in the summary table below.
|Articles 55-A, 55-B, 55-C, 55-D, 55-E, 55-F, 55-G, 55-H, 55-I, 55-J, 55-K, 55-L, 58-A and 58-B
(the “ANPD Provisions”)
|These provisions relate to the ANPD.||December 28th, 2018|
|Substantive LGPD provisions
(the “Substantive Provisions”)
|These provisions cover, among others, data processing principles, lawful bases for the processing of personal data, and data subject rights. Therefore, once they are effective, individuals may submit access, rectification, erasure and other applicable requests to controllers, and controllers might liable in the court sphere for the breach of substantive LGPD provisions, according to existing civil responsibility rules.||Up to September 17th, 2020|
|Articles 52, 53 and 54
(the “Penalty Provisions”)
|These provisions relate to the administrative penalties provided in the LGPD. By “administrative penalties”, we refer to the fines and other penalties for the breach of the LGPD that the ANPD may apply in the administrative sphere, such as blocking of personal data, the temporary suspension or the prohibition of personal data processing activities.||August 1st, 2021|
Please refer to our comments below for detailed explanations on the LGPD legislative process.
- LGPD Legislative Process
The LGPD was approved on August 14th, 2018, but it was not effective as of such date. The ANPD Provisions entered into force on December 28th, 2018. The Substantive and Penalty Provisions were originally intended to come into force in August 2020.
However, in the COVID-19 context, (i) Law No. 14,010/2020 established that the Penalty Provisions would come into force on August 1st, 2021; and (ii) provisional ruling MP 959/2020 was enacted by the Brazilian president, postponing the effects of the Substantive Provisions to May 3rd, 2021.
With respect to MP 959/2020, note that, in order to have permanent effects, a provisional ruling must be converted into law by the Legislative branch (Chamber of Representatives and the Senate) within 60 days, extendable by another 60-day period. Otherwise, it will lapse and be rendered ineffective. Also, if the original text of a provisional measure is changed by the legislators, the changes must be approved or vetoed by the Brazilian President before the provisional measure is finally converted into law. The deadline for MP 959/2020 to either lapse or be converted into law ended on August 26th, 2020.
On August 25th, the Chamber of Representatives deliberated the conversion of MP 959/2020 into law, modifying it to establish that the Substantive Provisions should be effective on December 31st, 2020. On August 26th, the Senate excluded from MP 959/2020 any provisions regarding the effectiveness of the Substantive Provisions, which led to a debate on whether the Substantive Provisions should become immediately effective or not.
By means of a note published on its official website, the Senate clarified that the Substantive Provisions are not yet effective. They will come into effect once the Brazilian President approves or vetoes the changes to MP 959/2020. As MP 959/2020 no longer rules about the effective date of the Substantive Provisions, the matter is settled, to the extent it is beyond the approval/veto authority of the Brazilian President. Considering that the deadline for the Brazilian President to present his approval/veto is of 15 business days, it is correct to state that the Substantive Provisions will come into upon the approval/veto of the changes to MP 959/2020 or September 17th, 2020, whichever occurs earlier.
Decree 10.474/2020 (the “Decree”) was published on August 27th, 2020, approving, among others the internal structure and the regulatory framework of the ANPD.
Pursuant to the LGPD, the ANPD will be part of the Federal administration and bound to the Executive Office of the Brazilian President. The two main bodies of ANPD are (i) the Board of Directors (the “Board”), the top executive body, composed of 5 members, including the Chairman, with normative, investigatory and corrective powers; and (ii) the National Data Protection and Privacy Council (the “Council”), a consulting body, composed of 23 members chosen among representatives of different bodies of the public administration, the Legislative Branch, the Judicial Branch and entities representing civil society organizations.
As per the Decree, the first ANPD officials will be appointed based on a reapportionment of the budget of the Ministry of the Economy, and the Brazilian President will have authority to appoint the Board and Council members. As already provided in the LGPD, the term in office of the Board members will be of 4 years (provided that the first Board members will have a term in office of 2, 3, 4, 5 and 6 years), and the term in office of the Council members will be of 2 years, reelection being permitted once. As 3 Council members have already been appointed (the representatives of the Ministry of the Public Prosecution, the Chamber of Representatives and the Senate), an open point is whether or not the appointment of these members shall be ratified by the Brazilian President in order to remain effective. Except for such 3 Council members, no other ANPD official has been appointed so far.
The Decree will come into force together with the publication of the appointment of the Chairman of the Board by the Brazilian President. According to the LGPD, during the 2 years following the beginning of the ANPD activities, it may be converted by the Executive Branch in an independent regulator.
For more information on these articles or any other issues involving labour and employment matters in Brazil, please contact Mihoko Sirley Kimura (Partner) of TozziniFreire Advogados at Msk@tozzinifreire.com.br or visit www.tozzinifreire.com.br.