Cybersecurity & Data Privacy / Government Relations
The Senate approved on Wednesday (May 29) the Provisional Measure No. 869/2018 (MP 869), with modifications, as a Bill Of Conversion (PLV) No. 7/2019, which amends some aspects of the Brazilian General Data Protection Law (Law No. 13,709/2018 or LGPD) and has as main characteristic the creation of the Data Protection National Authority (ANPD), vetoed by President Michel Temer at the time of the sanction of the LGPD.
Among the changes, the transitional legal nature of the ANPD is highlighted. The ANPD is created as an organ of the Federal Government member of the Presidency of the Republic, but it can be transformed into an indirect federal public administration entity and submitted to a special autocratic regime by the Executive Branch within 2 years from the date of entry into force of the ANPD’s regimental structure.
In addition to the changes in the structure and attributions of the ANPD, MP 869 brings other important changes, among them: (i) the possibility of sharing sensitive personal data between data controllers with an economic objective, provided that the exchange of such data is necessary for the provision of health services and pharmaceutical assistance to the interests of data subjects; (ii) the exemption of the public authority from informing the data subject about situations in which their data may be processed for compliance with a legal or regulatory obligation, as well as for the execution of public policies provided for in laws or agreements; (iii) the possibility of legal entities governed by private law, which are fully controlled by the public authorities, to handle all the data contained in databases created for the purposes of public security, national defense or state security, investigation and prosecution of infringements criminal proceedings; (iv) the release of data controllers of informing other agents with whom they have shared the content of data processing if this information is “proved impossible” to be carried out or implies a “disproportionate effort”; (v) reinstatement of sanctions for partial suspension of database operation, suspension of data processing and total or partial prohibition of processing activities; and (vi) by future ANPD regulation, the review of decisions made solely based on automated processing of personal data should be made by a natural person.
The vacatio legis period of the LGPD was also modified by the MP 869. According to it, the LGPD shall enter into force 24 months as of its publication date (except for the provisions regarding the ANPD, which are immediately effective). Originally, the LGPD determined an 18-month vacatio legis term, therefore the law would enter into force on February 2020. Due to the amendment, however, the LGPD is going to enter into force on August 2020.
The document now goes to the President of the Republic for sanction or veto, total or partial, within 15 business days as of its receipt. Should the President of the Republic not act within this term, the MP will be deemed tacitly sanctioned and will be promulgated by the President of the Republic or by the president of the Senate.