Federal Senate approves artificial intelligence regulatory framework
In December, the Federal Senate approved Bill 2.338/2023, which establishes the regulatory framework for artificial intelligence in Brazil. The proposal, approved in a symbolic vote and authored by Senate President Rodrigo Pacheco, aims to guarantee legal and ethical security in the use of AI and protect fundamental rights, especially copyright, with new rules that require large technology companies to publish copyrighted content used to train AI systems and it allows authors to veto the use of their works. It also provides for an experimental environment for negotiating remuneration with authors, taking into account the economic power of companies and the impact of the use of works. The use of protected works will be allowed for research, education, journalism and cultural preservation, as long as there are no commercial purposes or competition with the original work. The final draft of the Senate bill has been published and the text will now be analysed by the Chamber of Deputies.
The rules for the betting companies are now in force.
Since 1st January, only companies authorised by the Ministry of Prizes and Betting can operate legally in Brazil. More than a hundred companies were certified in August and will be able to offer online betting for up to three brands for the next five years. The following rules are applicable to the authorised companies: websites must have the Brazilian domain 'bet.br'. Bets must be placed on the punter's registered account by direct debit, and winnings must be paid out within 120 minutes of the event, always by electronic transfer. New websites can still obtain certification, which will be processed within 150 days. Foreign companies must have a national subsidiary registered with the CNPJ, based in Brazil, with Brazilian directors and a Brazilian partner holding at least 20% of the share capital. The list of authorised websites can be found online in the publications of the Office of Prizes and Betting.
Source: https://agenciabrasil.ebc.com.br/radioagencia-nacional/geral/audio/2025-01/novas-regras-para-sites-de-apostas-esportivas-passam-valer-hoje
Prohibition to certify online games related to "Jogo do Bicho".
The Undersecretariat of Control and Inspection of the Secretariat of Prizes and Betting of the Ministry of Finance (SPA/MF) has published the SEI Technical Note 3826/2024. The document advises that online fixed odds betting games that use rules or names related to "jogo do bicho" cannot be certified. The SPA concluded that 'jogo do bicho' is different from fixed-odds betting, as established by Laws Nos 13,756/2018 and 14,790/2023, because it is an illegal lottery modality. Therefore, online games using 'jogo do bicho' rules cannot be offered by fixed odds lottery operators, even if they have been previously certified. The technical note is intended to clarify the distinction between permitted and prohibited games and to reinforce the need to bring online games into compliance with the law. The SPA emphasises that 'jogo do bicho' is a criminal offence and therefore its offer on online betting platforms is prohibited. The regulation aims to ensure that online gambling operates within legal limits, protecting consumers and ensuring a more transparent and secure gambling market.
Source: https://www.gov.br/fazenda/pt-br/composicao/orgaos/secretaria-de-premios-e-apostas/arquivos/sei_46908324_nota_tecnica_3826.pdf
https://bnldata.com.br/reflexoes-sobre-a-adequacao-do-jogo-do-bicho-on-line-a-lei-14-790-2023/
An agreement between the ANPD and the ANS will strengthen data protection in the health sector.
In December, the National Data Protection Authority (in Portuguese, Autoridade Nacional de Proteção de Dados - ANPD) and the National Health Agency (in Portuguese, Agência Nacional de Saúde - ANS) signed a technical cooperation agreement (ACT) to promote information security and raise awareness of good practices in the health sector. The partnership, formalised after months of negotiations, will allow for more effective compliance with the Brazilian General Data Protection Regulation (in Portuguese, Lei Geral de Proteção de Dados - LGPD), guaranteeing legal certainty and transparency. Waldemar Gonçalves, CEO of the ANPD, stressed the importance of the agreement and the fundamental role played by the ANS in the negotiation process. It should be emphasised that health data is classified as sensitive by the LGPD and requires appropriate treatment to guarantee the privacy and security of the data subjects, so the ACT aims to meet this need and is the first ACT signed between the ANPD and a regulatory authority, marking a historic commitment to promote good data protection practices in Brazil.
Source: https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-e-ans-firmam-acordo-para-aprimorar-protecao-de-dados-na-area-de-saude
ANPD publishes new guide for DPOs
The ANPD publishes a new guide on the appointment and performance of the role of the DPO, a document that complements Resolution CD/ANPD No. 18 of July 2024, which details the regulations on the role of the DPO. The aim of the guide is to facilitate the interpretation of the regulation and to help the compliance with the law, in accordance with the Brazilian General Data Protection Regulation (in Portuguese, Lei Geral de Proteção de Dados - LGPD). In addition, the Guide provides good practices for data processing agents, including models of formal acts for the appointment of the DPO in the annexes. According to the relevant legislation, the DPO is the communication link between the data subject, the processing agent and the ANPD and has the task of guiding employees and contractors in the best practices for the protection of personal data.
Source: https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-lanca-guia-sobre-atuacao-do-encarregado
ANPD strengthens consumers' right to privacy
The National Consumer Secretariat (in Portuguese, Secretaria Nacional do Consumidor - Senacon) has warned against the practice of companies charging for extra services to protect personal data. According to the Brazilian General Data Protection Regulation (in Portuguese, Lei Geral de Proteção de Dados - LGPD), data protection is an inalienable right and must be guaranteed without extra cost. The National Data Protection Authority (in Portuguese, Autoridade Nacional de Proteção de Dados - ANPD) has reaffirmed that the protection of personal data is a right guaranteed by the LGPD. Companies must implement security measures at no extra cost. Wadih Damous, the National Secretary for Consumer Affairs, stressed that practices that make data protection conditional on the payment of fees are abusive and violate the LGPD and the Consumer Protection Code. The ANPD stresses that companies must implement security measures to prevent data leakage at no extra cost to consumers. Consumers can file complaints with the ANPD and Procons, report to the Public Prosecutor's Office and seek redress through legal action. Regulators must monitor and hold accountable companies that seek to profit from data insecurity.
Source: https://agenciagov.ebc.com.br/noticias/202412/protecao-de-dados-e-um-direito-garantido-ao-consumidor
SPA publishes decree to create group to tackle health impact of sports betting
The Secretariat for Prizes and Gambling (SPA) has set up an inter-ministerial working group on mental health and the prevention of harm caused by gambling. It includes representatives from the Ministries of Health, Sport, Finance and the Secretariat of the Presidency for Social Communication and focuses on developing strategies to prevent, mitigate harm and provide support to individuals and communities affected by compulsive gambling or in situations of vulnerability, taking into account the context of fixed odds betting. The Ordinance which implemented the referred group also limited the means of payment of the prizes, banning credit cards and requiring strict identification of players to prevent abuse and illegal practices. The group will promote educational campaigns on the risks of betting and guidelines for operators. The regulations aim not only at economic control, but also at social protection, prioritising the mental health and well-being of gamblers.
Source: https://www.gov.br/saude/pt-br/assuntos/noticias/2024/dezembro/governo-federal-cria-grupo-de-trabalho-para-enfrentar-impactos-na-saude-causados-por-apostas-feitas-no-brasil
ANPD orders preventive measures against X. Corp
The ANPD issued a decision that, among other things, suspends the personal data processing of people under the age of 18 for the purposes of training the platform's generative AI. X Corp must inform that it does not process personal data of children for AI training purposes and disable the option for users under 18 to share personal data for the purposes of Generative AI training. It has five days to comply with the decision. In addition, X.Corp must make changes to the Platform's Terms of Service and Privacy Policy to: (i) exclude the expression "for any purpose" from the Terms of Use, as it has the potential to cover the processing of personal data for any purpose, which is contrary to the criterion of specificity of purpose; (ii) make suggestions for improving the wording of the Terms of Use in order to delimit the purposes more precisely and to explicitly clarify to the data subject the extent to which these purposes affect his or her sphere of protection of personal data.
Source: https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-determina-adocao-de-medidas-preventivas-a-x-corp
ANPD inspects 20 companies for lack of DPO and adequate communication channel
The National Data Protection Authority (in Portuguese, Autoridade Nacional de Proteção de Dados - ANPD) has launched an inspection process involving 20 large companies (including Bluefit, Tiktok, Serasa, Dell, Latam, Uber, X, Cocoa Show) that have not provided the contact details of the person responsible for processing personal data, as required by Article 41 of the Brazilian General Data Protection Regulation (in Portuguese, Lei Geral de Proteção de Dados - LGPD). The measure also extends to organisations that, in addition to not providing an adequate communication channel to assist data subjects, offer channels that are not effective, making it difficult to exercise rights such as access, correction and deletion of personal data. The initiative is part of the monitoring cycle and is in line with the Priority Themes Map 2024-2025, which highlights the guarantee of data subjects' rights as one of the central axes of action for the authority.
Source: https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-fiscaliza-20-empresas-por-falta-de-encarregado-e-canal-de-comunicacao
ANPD publishes Regulatory Agenda 2025-2026
The National Data Protection Authority (in Portuguese, Autoridade Nacional de Proteção de Dados - ANPD) published its regulatory agenda for the 2025-2026 biennium on 11 December 2024. Its preparation took into account the contributions made by society through the reception of subsidies. The Agenda is the planning tool that brings together the ANPD's priority regulatory actions. Its aim is to make the Authority's regulatory process more transparent, predictable and efficient, to enable society to monitor its activities and to promote greater regulatory and legal certainty in relations with regulated operators. Among the 16 actions set out in the Regulatory Agenda, the following themes are under the Authority’s radar: (i) the legal hypothesis of consent, (ii) artificial intelligence, (iii) RIPD.
Source: https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-publica-agenda-regulatoria-2025-2026
ANPD releases English version of Technology Radar
Document highlights key points addressed in the original Portuguese study, conducted by the General Coordination of Technology and Research, and aligns with the Authority’s internationalization strategy, contributing to stronger dialogue with other organizations. This text, developed by ANPD’s General Coordination of Technology and Research, synthesizes the main issues covered in the volume on Generative Artificial Intelligence, exploring concepts such as “data scraping” or “web scraping”—which may involve the processing of personal data—and “synthetic content generation,” which can potentially include personal information. Both processes deal with the handling and possible exposure of personal data within generative AI systems.
Source: https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-releases-english-version-of-technology-radar
Data center market booming: Record investment boosts sector in Brazil and globally
Data center investment is on the rise around the world. In response to the explosive growth in demand for artificial intelligence applications, Microsoft has significantly increased its data center investments, which are expected to reach US$80 billion in the current fiscal year, which ends in June. This is more than five times the annual investment of Petrobras, Brazil's largest company. In Brazil, the companies Mapa Investimentos and Supernova will invest R$300 million in the construction of a data center in Leopoldina, Minas Gerais and in São Paulo, there are plans to build a 200 MW hyperscale data center. In addition, after the National Bank for Economic and Social Development (BNDES) launched a R$2 billion credit line for the data center sector in September, the city council of Eldorado do Sul, in Rio Grande do Sul, passed a law to create the country's first data center technology hub. With an initial investment of R$3 billion and an expected creation of more than 3,000 direct and indirect jobs, the center has the potential to become the largest in Latin America.
Source: https://megawhat.energy/economia-e-politica/empresas/empresas-de-infraestrutura-investem-r-300-milhoes-em-data-center-em-mg/
https://braziljournal.com/microsoft-investe-us-80-bi-em-data-centers-de-ia/
https://www.estado.rs.gov.br/sancionada-lei-que-cria-primeiro-polo-de-tecnologia-de-data-centers-do-brasil
https://www.bnamericas.com/pt/noticias/tecto-adquire-terreno-para-projeto-de-datacenter-em-hiperescala-de-200-mw
