Brazil issues the rule for the creation of its National Data Protection Authority and extends the adaptation period to the General Data Protection Law to August 2020

The Executive Order (Medida Provisória) no. 869/18 (“MP 869/18”) published on December 28, 2018 has included some changes to the Law no. 13.709/2018 (“LGPD”), including, among others, the creation of the National Data Protection Authority (“ANPD”) and extension of the adaptation period to the LGPD from February to August 2020.

According to the new regulation, the ANPD will be organized as a federal public administrative agency, subordinated to the Presidency of the Republic, with technical independency but without financial or budget autonomy.

The ANPD will have the following structure:

(i)             Directive Council: the highest direction body, composed by 5 members appointed by the President;

(ii)           National Council of Personal Data and Privacy Protection: an advisory council, composed by 23 non-remunerated members, being (a) 11 from different spheres of government, (b) 4 from civil society entities acting in the data protection area, (c) 4 from scientific, technologic and innovation institutions and (d) 4 members representatives of the business sector related to the data protection area; and

(iii)         Other bodies: the controller agency (corregedoria), an ombudsman (ouvidoria), a legal consulting body, and administrative and specialized units necessary for the enforcement of the law.

The ANPD’s core competence is to ensure the personal data protection, with the following main attributions:

(i)             Regulation: issuance of regulations, procedures and resolutions (on the administrative level) regarding the interpretation of the LGPD, its competences and non-regulated situations.

(ii)           Controlling and sanctioning: requesting information, implementation of simplified mechanisms of claims registry, controlling and applying sanctions (with exclusive powers) and communicating with the authorities in charge of criminal infractions and violations performed by public entities.

(iii)         Education: dissemination of data processing rules and policies, stimulating the adoption of standards for products and services that facilitate the control of the data treatment by the data subject and preparing studies on national and international data protection and privacy practices.

Among the other changes implemented by MP 869/18 in the LGPD, point out the possibility of having legal entities acting as the data protection officer.

It is important to bear in mind that the MP 869/18 has immediate effects, but it is still subject to appreciation by the Brazilian Congress, when its text maybe approved in full, rejected or approved with changes.

The creation of the ANPD is a significant step for the effectiveness of the LGPD, being essential for the clarification of essential matters (such as mechanisms of international data transfer and criteria for the application of the legitime interest), its enforcement and application of the relevant sanctions.

Finally, regardless the extension of the adaptation period to 24 months, we maintain our recommendation that the entities should start the implementation of the procedure for the compliance with the LGPD requirements as soon as possible since the most recent European experience of  adaptation of the European market to the requirements imposed by the General Data Protection Regulation (GDPR), has shown that a significant amount of the European entities was not able to be fully compliant within such period.

For further information about the contents of this newsletter, please contact:

Marcela Figueiró
marcela.figueiro@nbfa.com.br
(11) 3707-8370

Brunno Morette
brunno.morette@nbfa.com.br
(11) 3707-8370

Francisca Sousa Guedes
francisca.guedes@nbfa.com.br
(11) 3707-8370

This memorandum has been prepared solely for the clients of this firm and aims at informing major changes and news of interest in the legal field. In the event of doubts, the lawyers will be at your complete disposal for further clarification..
The information included in this Newsletter is intended to provide the clients of our firm with general updates and does not constitute a legal opinion or professional advice in relation to any specific matter, present or future that our firm is or might be currently involved with. The English version of this Newsletter is a free translation from Portuguese.
2017 NBF|A Advogados. All rights reserved. The exploitation, reproduction, private or public distribution, total or partial modification are prohibited without prior written consent from NBF|A Advogados.