Brazil’s LGPD Sanctions Will Take Effect in August 2021
On June 10, 2020, Bill No. 1,179 of 2020—now Law No. 14,010 of 2020—confirmed the validity of articles 52, 53 and 54 of the Brazilian General Law for the Protection of Personal Data (“LGPD”) as of August 1, 2021. These articles provide the administrative sanctions that the National Data Protection Authority (“ANPD”) may apply to data processing agents (controller and operator) for violations of the LGPD.
However, Law No. 14,010 of 2020 does not affect the other articles of the LGPD that, as of now, are set to enter into force on May 3, 2021, according to Provisional Measure No. 959/2020. And until the National Congress rejects, approves or changes this provisional measure, or even if it expires on August 27, 2020, the future of the LGPD remains uncertain.
It is important to note that, also on June 10, 2020, several Brazilian trade and industrial associations (agriculture and livestock; trade in goods, services and tourism; industry; financial institutions; health; general insurance, private pension and life, supplementary health and capitalization-CNseg; transportation; and the COB system) sent a letter to the President of the Brazilian Chamber of Deputies asking for the approval of Provisional Measure No. 959/2020 so that the rest of the LGPD will enter into force no sooner than May 2021. These trade and industrial associations, which represent a good portion of the Brazilian economy, base that position on the fact that the ANPD has yet to be formed and say that the ANPD being operational would be essential to companies’ ability to comply with LGPD standards—and they note that Brazilian companies need to focus now on recovering from the effects of the pandemic, with almost all having had their operations severely impacted by COVID-19.
It is essential to point out that articles 55-A to 55-L, 58-A and 58-B of the LGPD, which create and regulate the ANPD, have been in full force since December 28, 2018.
Finally, the entry into force of the sanctions, which are of a purely administrative nature, would not preclude other actions to enforce the LGPD. The data subjects and several public consumer protection authorities, public authorities for the regulation of specific fields (the Central Bank, the Health Surveillance Agency, the Telecoms Agency, the Film Agency, etc.), public prosecutors, and public defenders, as well as private associations, may use the LGPD as grounds to file lawsuits against the data controllers, claiming the improper treatment of personal data. In this sense, even if the administrative sanctions are not to take effect until August 2021, companies should plan to be in compliance with all LGPD rules by no later than May 3, 2021.
