Brazil issues the rule for the creation of its National Data Protection Authority and extends the adaptation period to the General Data Protection Law to August 2020
The Executive Order (Medida Provisória) no. 869/18 (“MP 869/18”) published on December 28, 2018 has included some changes to the Law no. 13.709/2018 (“LGPD”), including, among others, the creation of the National Data Protection Authority (“ANPD”) and extension of the adaptation period to the LGPD from February to August 2020.
According to the new regulation, the ANPD will be organized as a federal public administrative agency, subordinated to the Presidency of the Republic, with technical independency but without financial or budget autonomy.
The ANPD will have the following structure:
(i) Directive Council: the highest direction body, composed by 5 members appointed by the President;
(ii) National Council of Personal Data and Privacy Protection: an advisory council, composed by 23 non-remunerated members, being (a) 11 from different spheres of government, (b) 4 from civil society entities acting in the data protection area, (c) 4 from scientific, technologic and innovation institutions and (d) 4 members representatives of the business sector related to the data protection area; and
(iii) Other bodies: the controller agency (corregedoria), an ombudsman (ouvidoria), a legal consulting body, and administrative and specialized units necessary for the enforcement of the law.
The ANPD’s core competence is to ensure the personal data protection, with the following main attributions:
(i) Regulation: issuance of regulations, procedures and resolutions (on the administrative level) regarding the interpretation of the LGPD, its competences and non-regulated situations.
(ii) Controlling and sanctioning: requesting information, implementation of simplified mechanisms of claims registry, controlling and applying sanctions (with exclusive powers) and communicating with the authorities in charge of criminal infractions and violations performed by public entities.
(iii) Education: dissemination of data processing rules and policies, stimulating the adoption of standards for products and services that facilitate the control of the data treatment by the data subject and preparing studies on national and international data protection and privacy practices.
Among the other changes implemented by MP 869/18 in the LGPD, point out the possibility of having legal entities acting as the data protection officer.
It is important to bear in mind that the MP 869/18 has immediate effects, but it is still subject to appreciation by the Brazilian Congress, when its text maybe approved in full, rejected or approved with changes.
The creation of the ANPD is a significant step for the effectiveness of the LGPD, being essential for the clarification of essential matters (such as mechanisms of international data transfer and criteria for the application of the legitime interest), its enforcement and application of the relevant sanctions.
Finally, regardless the extension of the adaptation period to 24 months, we maintain our recommendation that the entities should start the implementation of the procedure for the compliance with the LGPD requirements as soon as possible since the most recent European experience of adaptation of the European market to the requirements imposed by the General Data Protection Regulation (GDPR), has shown that a significant amount of the European entities was not able to be fully compliant within such period.
For further information about the contents of this newsletter, please contact:
Francisca Sousa Guedes