The Presidency of the Republic adopted, on 27 December 2018, Provisional Measure No. 869 of 27 December 2018 (‘the Provisional Measure’), which provides for the creation of the Brazilian data protection authority (‘ANPD’) and was published in the Official Diary of the Union on 28 December 2018. In particular, the Provisional Measure amends Law No. 13.709 of 14 August 2018 Which Provides for the Protection of Personal Data and Amends the Federal Law No. 12.965 of 23 April 2016 (‘the Data Protection Law’), and confers certain powers to the ANDP.
Renato Leite, Partner at Baptista Luz Advogados, told DataGuidance, “The ANDP was mentioned exactly 47 times in the Data Protection Law enacted last August. Some provisions would only have an effect if the authority was created, such as what to do with old databases. Therefore, the lack of an authority made the Data Protection Law become limp. However, the lack of power would, eventually, be fulfilled by other competent powers, such as the Public Prosecutor Offices, both at the state and federal level. Hence, a harmonised interpretation of the law and a concentrated enforcement would be really hard to achieve. Now, with the ANPD, businesses will know to whom and what to look for, and will have a straight channel on which to communicate. The ANPD will provide for a much more stable application of the law, and, for instance, more legal certainty, that will probably spur technological and economic development.”
The Provisional Measure establishes that the ANPD will be responsible for, among other things, ensuring the protection of personal data, supervising and applying sanctions in the event that the processing of data is carried out in violation of the Data Protection Law, and requesting information at any time from the controllers and processors of personal data who carry out personal data processing operations. The Explanatory Memorandum No. 00239/2018 to the Provisional Measure noted that whilst the ANDP was originally included in the Data Protection Law, the President of the Republic vetoed the chapter which dealt with it.
The core element that will need to be analysed over time is if the ANPD is indeed independent and autonomous
Cristiane Manzueto, Counsel at Tauil & Chequer Advogados in association with Mayer Brown, noted, “The creation of the ANPD is a big step in terms of data protection in Brazil. [However,] considering that the Data Protection Law is not even in force yet, the President could have waited and created the ANDP […] through legislation without the need to do it through a Provisional Measure, which is [a legal act] issued by the President alone, usually reserved for urgent and relevant matters valid for up to 120 days that still needs to be converted into law.”
The Provisional Measure outlines that the ANDP will be composed of a board of five directors, who will be appointed by the President of the Republic, as well as of a National Council for the Protection of Personal Data and Privacy, which will consist of 23 representatives from bodies in a number of different sectors. In addition, the ANDP will be established as an organ of the federal public administration, which is part of the Presidency of the Republic.
Leite concluded, “It is hard to say whether the sole creation of the ANPD will help Brazil to meet the international standards that might provide, [for example,] an adequacy decision from the European Commission under Article 45 of the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR). The core element that will need to be analysed over time is if the ANPD is indeed independent and autonomous as required by the GDPR. The previous version of the law provided such characteristics. However, [since] the current ANPD is directly tied to the Presidency, and the text of the executive order only provides for technical independence […] we are yet to assess if it will meet those standards. Meanwhile, last year Brazil was granted with an observer status of the Convention for the Protection of Individuals with Regard to the Processing of Personal Data (‘Convention 108’). If this path is pursued, and Brazil finally accesses Convention 108, that might help it be granted with an adequacy decision. Only time and politics will tell.”
RUMER RAMSEY Junior Privacy Analyst