Notícias, artigos e boletins

« Back

August 28, 2020

LGPD Updates: Effectiveness and ANPD Structure

Cybersecurity & Data Privacy

After some back and forth, we have seen relevant legislative developments over the last days regarding the effectiveness of the Brazilian General Data Protection Law (Law No. 13,709/2018 – LGPD) and the definition of the structure and regulatory framework of the National Data Protection Authority (ANPD).

Effectiveness

The LGPD was enacted in 2018, with delayed effects. Some LGPD provisions are already effective, while others have yet to come into force. This week, the open points regarding the different effective dates of the LGPD provisions were finally determined, as indicated in the summary table below.

Provisions

Subject

Effective date

Articles 55-A, 55-B, 55-C, 55-D, 55-E, 55-F, 55-G, 55-H, 55-I, 55-J, 55-K, 55-L, 58-A and 58-B
(ANPD Provisions)

These provisions relate to the ANPD.

December 28, 2018

Substantive LGPD provisions
(Substantive Provisions)

These provisions cover, among others, data processing principles, lawful bases for the processing of personal data, and data subject rights. Therefore, once they are effective, individuals may submit access, rectification, erasure and other applicable requests to controllers, and controllers might be liable in the court sphere for the breach of substantive LGPD provisions, according to existing civil responsibility rules.

Up to September 17, 2020

Articles 52, 53 and 54
(Penalty Provisions)

These provisions relate to the administrative penalties provided in the LGPD. By “administrative penalties”, we refer to the fines and other penalties for the breach of the LGPD that the ANPD may apply in the administrative sphere, such as blocking of personal data, the temporary suspension or the prohibition of personal data processing activities.

August 1, 2021

 Please refer to our comments below for detailed explanations on the LGPD legislative process.

  • LGPD Legislative Process

The LGPD was approved on August 14, 2018, but it was not effective as of such date. The ANPD Provisions entered into force on December 28, 2018. The Substantive and Penalty Provisions were originally intended to come into force in August, 2020.

However, in the COVID-19 context, (i) Law No. 14,010/2020 established that the Penalty Provisions would come into force on August 1, 2021; and (ii) provisional ruling MP (Provisional Measure) No. 959/2020 was enacted by the Brazilian President, postponing the effects of the Substantive Provisions to May 3, 2021.

With respect to MP No. 959/2020, note that, in order to have permanent effects, a provisional ruling must be converted into law by the Legislative branch (Chamber of Representatives and the Senate) within 60 days, extendable by another 60-day period. Otherwise, it will lapse and be rendered ineffective. Also, if the original text of a Provisional Measure is changed by the legislators, the changes must be approved or vetoed by the Brazilian President before the Provisional Measure is finally converted into law. The deadline for MP No. 959/2020 to either lapse or be converted into law ended on August 26, 2020.

On August 25, the Chamber of Representatives deliberated the conversion of MP No. 959/2020 into law, modifying it to establish that the Substantive Provisions should be effective on December 31, 2020. On August 26, the Senate excluded from MP No. 959/2020 any provisions regarding the effectiveness of the Substantive Provisions, which led to a debate on whether the Substantive Provisions should become immediately effective or not.

By means of a note published on its official website, the Senate clarified that the Substantive Provisions are not yet effective. They will come into effect once the Brazilian President approves or vetoes the changes to MP No. 959/2020. As MP No. 959/2020 no longer rules about the effective date of the Substantive Provisions, the matter is settled, to the extent it is beyond the approval/veto authority of the Brazilian President. Considering that the deadline for the Brazilian President to present his approval/veto is of 15 business days, it is correct to state that the Substantive Provisions will come into upon the approval/veto of the changes to MP No. 959/2020 or September 17, 2020, whichever occurs earlier.

  • ANPD

Decree No. 10,474/2020 (Decree) was published on August 27, 2020, approving, among others the internal structure and the regulatory framework of the ANPD.

Pursuant to the LGPD, ANPD will be part of the Federal administration and bound to the Executive Office of the Brazilian President. The two main bodies of ANPD are:

  1. The Board of Directors (Board), the top executive body, composed of 5 members, including the Chairman, with normative, investigatory and corrective powers;
  2. The National Data Protection and Privacy Council (Council), a consulting body, composed of 23 members chosen among representatives of different bodies of the public administration, the Legislative Branch, the Judicial Branch, and entities representing civil society organizations.

As per the Decree, the first ANPD officials will be appointed based on a reapportionment of the budget of the Ministry of the Economy, and the Brazilian President will have authority to appoint the Board and Council members. As already provided in the LGPD, the term in office of the Board members will be of 4 years (provided that the first Board members will have a term in office of 2, 3, 4, 5 and 6 years), and the term in office of the Council members will be of 2 years, reelection being permitted once. As three Council members have already been appointed (the representatives of the Ministry of the Public Prosecution, the Chamber of Representatives and the Senate), an open point is whether or not the appointment of these members shall be ratified by the Brazilian President in order to remain effective. Except for such three Council members, no other ANPD official has been appointed so far.

The Decree will come into force together with the publication of the appointment of the Chairman of the Board by the Brazilian President. According to the LGPD, during the 2 years following the beginning of the ANPD activities, it may be converted by the Executive Branch in an independent regulator.

Partners

« Back