The “Brazilian General Data Protection Law” (Law No. 13709/2018), or “LGPD,” has generated much doubt and uncertainty since its enactment on August, 14, 2018, because some of its provisions were already in force, while others were not, leaving many to ask, "What has happened since the law’s enactment?”
Some background: Initially, the LGPD was expected to be fully in force in February 2020. Meeting this deadline was considered important in order to allow sufficient time for companies and other public entities to adapt to the LGPD and for the National Authority for Protection of Data ("ANPD"), an authority being created to regulate, inspect and create guidelines, to plan for regulating and enforcing the LGPD. Subsequently, Provisional Measure (“PM”) 869/18 extended the entry into force to August 2020, and later, due to the COVID-19 outbreak, PM 959/20 was published in the Official Gazette of the Federal Executive, postponing LGPD's effectiveness to May 2021.
On August 25, just one day before it was set to expire, PM 959/20 was put to a vote by the House of Representatives, and the LGPD was approved to come into force even earlier, on December 31, 2020. Soon after, it was sent to the Senate, which, in turn, went against the House of Representatives, considering that Article 4 of the PM 959/20 was aggrieved. From then on, the period of 15 working days for the LGPD to come into force would be extended, regardless of President Jair Bolsonaro's sanction or veto. As expected, the president sanctioned the bill, arising from the altered PM 959, on Thursday, September 17, 2020. This means that the normative structure of the LGPD is now fully enforceable, with the exception of the administrative sanctions, which are provided for in articles 52, 53 and 54 and will come into force in August 2021, by way of Law 14.010/20.
Regarding the creation of the ANPD, the government published in the Official Gazette dated August 27, 2020, Decree No. 10.474/20, which approves the ANPD's organizational structure. Although articles 55A, 55L, 58A and 58B of the LGPD have been in force since 2018, a structure to organize the authority had not been disclosed, which is of utmost importance for the start of ANPD activities. Therefore, in addition to other provisions, 36 commissioned and trust positions were created, which will be filled in the coming months; to date, there have been no appointments.
However, despite the progress made in defining the organization of the ANPD, its regulatory role still needs to be determined. Consequently, we will have a law in force with interpretive gaps to be filled by the ANPD, which is not yet fully structured to exercise its primary function of guiding and implementing the LGPD. The lack of guidelines means that entities will have to interpret the rules on their own, which could lead to conflicts that will have to be handled in the Courts of Justice.
In this current scenario, companies must adapt to the norms foreseen in the LGPD.
Although we do not know when the ANPD will actually be formed and operational, the effectiveness of the LGPD makes its obligations entirely enforceable, except by the administrative sanctions which were postponed to August, 2021. Consequently, it is extremely important that companies become compliant with the law as soon as possible because entities such as PROCON, the Public Prosecutor’s Office, the National Consumer Secretariat, State Secretariats and Class Entities can take charge of monitoring compliance with the LGPD, and, in addition to judicially seeking corporate liability for breaching the LGPD, they may also apply sanctions based on other laws such as the Brazilian Internet Law Framework (Marco Civil da Internet) and the Code of Consumer Defense and Protection (Código de Defesa do Consumidor).