Provisional measure that establishes the creation of the national data protection authority is enacted in Brazil

The Provisional Measure no. 869 of December 27, 2018 (“MP 869/2018”) was published on December 28, 2018, creating the National Data Protection Authority (“ANPD”) and amending provisions of the Brazilian General Data Protection Law (Federal Law no. 13,709/2018).

The President has initially vetoed the creation of the National Data Protection Authority due to legal irregularities in view of its creation by the legislative sphere.

Thus, please find below the main points of modification of the LGPD by the MP 869/2018:

• National Authority of Data Protection (ANPD): After the veto in the original text of the LGPD, the Provisional Measure 869 creates the National Authority of Data Protection, a federal public administration body, member of the Presidency of the Republic and which has technical autonomy. The ANPD will be composed by a board of directors, a national council, a inspection body, a ombudsman body, its own legal advisory body and administrative and specialized units for the enforcenment of the LGPD. Among its various competences, the ANPD will (i) issue regulations and procedures on the protection of personal data; (ii) deliberate, at an administrative level, upon the interpretation of the LGPD; (iii) supervise and apply sanctions in the event of data processing performed in violation of the legislation; (iv) implement simplified mechanisms for recording complaints about the processing of personal data in violation of the LGPD; and (v) request information, at any time, to controllers and processors of personal data that carry out processing operations of personal data; among others. It should also be noted that MP 869/2018 establishes to the ANPD the main competence to apply the sanctions provided by the LGPD, whose other competences will prevail over the related competences of other entities or public administration bodies.

• National Council for the Protection of Personal Data and Privacy: With regard to the National Council which makes part of the ANPD, Provisional Measure 869 establishes that the body shall be composed by 23 representatives appointed by the President, with two-year unpaid mandates. The Council will be responsible for, among other functions, (i) propose strategic guidelines for the creation of the National Policy for the Protection of Personal Data; (ii) suggest actions to be carried out by the ANPD; and (iii) prepare studies and conduct public debates and hearings about the protection of personal data.

• Amendment of the vacatio legis to 24 months: Another relevant modification brought by the Provisional Measure 869 was the extension of the vacatio legis of the LGPD to 24 months after its original publication, previously determined as 18 months. With this change, the LGPD will fully enter into force in August 2020, postponing the deadline for compliance with the law previously established to February 2020.

• Officer: With the new redaction of section VIII of article 5 of the LGPD, the function of the Data Protection Officer in charge of personal data treatment will no longer be restricted to be occupied by individuals.

• Data Treatment for Academic Purposes: The article 4 of the LGPD has been amended so that no legal bases are required for the treatment of personal data for academic purposes. The treatment of such data is included as one express exception to the applicability of the LGPD.

• Treatment of Data Related to Public Safety by Private Limited Companies: Furthermore, paragraph 4 of article 4, which prevented the totality of personal data of databases related to public safety, State safety, national defense or investigations of criminal offenses, from being conducted by any private limited companies, was revoked. In view of this revocation and the amendment of paragraph 3, the processing of these data may be carried out by persons under private law, provided that under the guardianship of a public authority, without further obligation to report it to the National Authority.

• Treatment of Personal Data: The obligation to inform the data subject of the legal bases of treatment was revoked when that treatment is based on the hypothesis of (i) compliance with a legal or regulatory obligation by the controller; and (ii) treatment and shared use by the Public Administration of data necessary for the execution of public policies.

• Sharing and Portability of Sensitive Personal Health Data: Article 11 of the LGPD has been amended to include the possibility of sharing or use sensitive personal health data for the purpose of obtaining economic advantage in cases where its communication is necessary for the adequate provision of supplementary health services, as well as its portability, provided that it is consented to by the data subject.

• Right to Review Automated Decisions: The right to review decisions made solely based of automated processing has been amended to exclude the obligation of this review from being necessarily conducted by a natural person.

• Communication and Shared Use of Data among Legal Entities of Public and Private Sector: The legal bases for sharing personal data from the public sector databases to private entities has been extended, now including hypothesis such as when such transfer is supported by a legal provisions or agreements, or to preven fraud and irregularities, among others. In addition, it will no longer be necessary to inform the ANPD about such sharing of data between public and private entities.

In case of any doubts about this subject, please do not hesitate to contact us.

 

CONTACTS:
Paula Mena Barreto
Partner
T: +55 21 3262-3028
E: paula.menabarreto@cmalaw.com

Manoela Esteves
Lawyer
T:+55 21 3262-3042
E:manoela.esteves@cmalaw.com