This week, Brazil’s Central Bank published BCB Resolution No. 342 of September 26, 2023, which created a new obligation for financial institutions to report security incidents related to Pix – the Brazilian instant payment method, created by the Central Bank to transfer funds between accounts in seconds.
The obligation to report security incidents to account owners (if that owner is a natural person) arises from any incident involving personal data in databases related to Pix's infrastructure or its components.
Therefore, reporting is mandatory when the Pix database is involved, even if the financial or payment institution that is established as a the participant providing the account is not responsible for the incident.
It is particularly interesting that the resolution states that reporting is mandatory "even if it does not entail a relevant risk or damage to the data subjects," which expressly bypasses the triggers contained in the Brazilian General Data Protection Law (LGPD).
The Central Bank of Brazil will also establish the operating procedures for the report in a future document.
It should be noted that penalties under BCB Resolution No. 177 of December 22, 2021 (Pix Penalties Manual) may be applied if these incidents are not reported.
Mayer Brown is a global legal services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown Hong Kong LLP (a Hong Kong limited liability partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) (collectively, the “Mayer Brown Practices”). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC (“PKWN”) is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. More information about the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website.
“Mayer Brown” and the Mayer Brown logo are the trademarks of Mayer Brown.
Attorney Advertising. Prior results do not guarantee a similar outcome.