The Joint Committee on Provisional Measure No. 869 of 27 December 2018 (‘the Provisional Measure’) approved, on 7 May 2019, a report (‘the Report’) amending the Provisional Measure, which establishes the Brazilian data protection authority (‘ANPD’). In particular, the Report creates certain competences and guarantees technical and decision-making autonomy for the ANPD, which is the responsible body for ensuring the protection of personal data under Law No. 13.709 of 14 August 2018 Which Provides for the Protection of Personal Data and Amends the Federal Law No. 12.965 of 23 April 2014 (‘LGPD’).
Alan Campos Elias Thomaz, Associate at Mattos Filho, Veiga Filho, Marrey Jr e Quiroga Advogados, told DataGuidance by OneTrust, “The LGPD originally provided that it would enter into force in February 2020. The Provisional Measure extended the deadline for organisations to become compliant with the LGPD, and the entry into force date moved to August 2020. The extension was kept by the Report approved by the Joint Committee. Nevertheless, if the Provisional Measure is shelved, or not voted on by the House of Representatives and the Senate, until 3 June 2019, it will lose its validity, and the entry into force date will move back to February 2020.”
In addition to conferring certain powers to the ANPD, the Report goes further in implementing changes to its structure, as well as the role it has in data protection in Brazil. In particular, the Report confers competences to the ANPD that were established by the LGPD but withdrawn by the Provisional Measure, such as the power to suspend a database operation and to prohibit the exercise of activities related to information processing.
It is difficult to foresee if any change to the ANPD’s powers will be proposed in the following days, but this is not expected to occur
Thomaz outlined, “The Report maintains that the ANPD is connected to the Cabinet of the Presidency, as originally provided by the Provisional Measure, but certain changes to the ANPD’s structure were approved with the intent to grant the ANPD more independency, [for example,] how its members are indicated, approved and dismissed, as well as how it will be funded. Enforcement powers of the ANPD have not materially changed in the Report; it will oversee, issue guidelines and enforce data protection laws in the country. In addition, other minor changes were approved in the Report, [such as] changes regarding the [scope] of the LGPD to regulate national security issues, data portability rights, appointment of the data protection officer, and the need to have automated decisions reviewed by individuals, among other topics.”
Finally, the Report allows for data subjects to file complaints with the ANPD if it is proven that they have first attempted to solve their complaint with the data controller, and also prohibits the communication or shared use of sensitive personal health data in order to obtain an economic profit.
Thomaz concluded, “After the Report’s approval, the Provisional Measure has to be voted on by the Plenary of the House of Representatives and the Senate, successively. If the Senate approves the House of Representatives’ text without any changes, the proposal will move forward to the Presidency for signature, or if approved with changes, the text will move back to the House of Representatives for final approval, and to the Presidency for signature. If the Provisional Measure is shelved by either the House of Representatives or the Senate, or not voted on by 3 June, it will lose its validity, and the ANPD will not be created. It is difficult to foresee if any change to the ANPD’s powers will be proposed in the following days, but this is not expected to occur.”
Alexander Fetani Junior Privacy Analyst