Big Changes to ANPD with Provisional Measure No. 1,124

On Monday, Provisional Measure No. 1,124 was published, amending Law No. 13,709 of 2018—the Brazilian General Personal Data Protection Law (LGPD)—which brings significant changes to the configuration of the Brazilian National Data Protection Authority (ANPD).

Provisory Act nº 1.124 of 2022 does not modify ANPD’s authorities or its overall organizational structure provided for in art. 55 and following of the LGPD but essentially transforms the ANPD into an autarchy of a special nature. To date, the ANPD has been an integral body of the Presidency, as provided for in its Regimental Structure. When the ANPD's new Regimental Structure is published, the ANPD will be endowed with technical and decision-making autonomy, its own assets and a legal personality separate from the Presidency.

While still needing to be approved by the National Congress to be converted into a law, the provisional measure is already in force.

This change brings practical consequences, such as:

• Greater independence and autonomy levels for the ANPD. Being considered an autonomous entity is essential for inspection and sanctioning bodies, and this change removes ANPD’s hierarchical subordination, giving the ANPD autonomy similar to that of other special regime agencies, such as other Brazilian regulatory agencies and the Brazilian Central Bank.
• Enabling the ANPD to act autonomously before the Judiciary. By becoming an autarchy of a special nature, the ANPD acquires procedural autonomy, which is highly relevant to the plan for personal data protection in the country, increasing ANPD’s enforcement abilities. Therefore, it is possible for the ANPD to file public civil actions.
• One further step on the path toward the European Union recognizing Brazil as a country with an adequate level of personal data protection. In the EU, there are some requirements for this under the General Data Protection Regulation—GDPR. One of the elements analyzed to assess the level of personal data protection compliance is the independence and non-subordination of the authority responsible for the personal data protection in the country. This recognition would be beneficial for Brazil.