27/08/2020

Technology &  Regulation in the Spotlight

After a long period of uncertainty regarding its schedule, Brazil’s new data protection law – Lei Geral de Proteção de Dados Pessoais (“LGPD“), takes immediate effect as of 27 August 2020.

In addition, the administrative enforcement and sanctions under the LGPD, which were planned to become effective this summer, are postponed until 1 August 2021. These penalties range from warnings to fines of up to 2% of the company’s gross revenue in Brazil in the previous fiscal year. While the administrative enforcement would be postponed, the immediate implementation of the LGPD’s main provisions enables individuals to bring civil lawsuits in cases of LGPD violations.

The LGPD is Brazil’s first comprehensive data protection law, and is in many ways substantially similar to the European General Data Protection Regulation (“GDPR“). Prior to the LGPD, data protection in Brazil was spread across various legislations.

The LGPD applies extraterritorially to companies offering services to Brazilian residents, irrespective of the country in which the company or the data are located. Other similarities between the LGPD and the GDPR include, inter alia, principles and legal bases for processing of personal data, differentiation between controllers and processors and their requirement to implement security measures, various data subjects’ rights and the requirement to appoint a data protection officer.

In addition, under the LGPD Brazil will establish a data protection authority – the National Data Protection Authority (“ANPD“). The administrative decree to create the ANPD is ready and likely to be published promptly. Once the ANPD commences operation, it is expected to issue a set of regulatory guidelines concerning the implementation of the LGPD. Data breach notifications to the ANPD will also become mandatory under the LGPD.

The LGPD requires adjustments to internal and external data processing policies and procedures of companies servicing data subjects in Brazil. Please feel free to contact us if you have any questions regarding the implications of the LGPD and how they may affect your compliance efforts.

********************

Feel free to contact us with any further question or comments regarding the update and subjects detailed above.

Kind regards,

Ariel Yosefi, Partner

Co-Head | Technology & Regulation Department

Herzog Fox & Neeman