The General Personal Data Protection Law - LGPD (Law No. 13,709/18), which brings in rules on how personal data shall be processed, will enter into force within the next few days, as soon as the bill of law converting Executive Order No. 959/20 is signed by the Brazilian President.
LGPD brought in a new system of rules for the processing of personal data in Brazil and was scheduled to be implemented on August 16, 2020. Because of the covid-19 pandemic, debates and initiatives related to a potential postponement of the LGPD have been taking place within the Brazilian Congress since March of 2020. On April 29, the Executive published Executive Order 959 to put into operation the monthly emergency benefit paid due to the pandemic and to extend the LGPD implementation to May 3, 2021.
In an extraordinary deliberative session of the House of Representatives held on August 25, the conversion into law of Executive Order 959 was approved, contemplating an amendment that established the entry into force of LGPD by the end of this year. However, during a virtual floor session held on August 26, the Speaker of the Federal Senate received a question of order considering the pre-judgment of the matter by the floor previously. Thus, the provision in Executive Order 959 dealing with the extension of the LGPD was recognized as moot and withdrawn from the text.
Given that scenario, the effective entry into force of the LGPD will occur after signature or veto of the conversion bill that amended the original text of Executive Order 959, as per article 62, paragraph 12, of the Federal Constitution, which should occur in the coming days. Articles 52, 53, and 54 of the LGPD, which deal with administrative sanctions, will only enter into force on August 1, 2021, as set forth in Law No. 14,010/20.
Also, on August 26, the Federal Executive issued Decree No. 10,474/20 approving the regulatory structure and the statement of commission positions and functions of trust of the National Data Protection Authority (ANPD). The decree will enter into force on the date of publication of the appointment of the ANPD's chief executive officer in the Federal Official Gazette.
Under the terms of the LGPD, the ANPD's president and the other members of the ANPD's executive board shall be chosen by the President of Brazil and appointed after approval by the Federal Senate.
What to do?
It is important to resume or accelerate ongoing adequacy projects and work with contingency scenarios, depending on the degree of maturity of the respective projects. It will also be advisable to monitor the developments of the implementation of the ANPD in the coming days, including the profile of the Executive Board.
The LGPD will enter into force without further regulation by the ANPD and with the chance that it will not even have its executive board appointed. Although administrative sanctions are postponed until August of 2021, the entry into force of the law makes its obligations enforceable, including allowing for the civil liability of processing agents vis-à-vis the personal data subjects. In addition, other administrative sanctions in the Brazilian legal system, such as those provided for in the Consumer Protection Code or the Brazilian Civil Rights Framework for the Internet, are in force and can be fully applied when connected to violations related to personal data.
