Photo by Markus Spiske on Unsplash
While many countries in the world have established and are already enforcing their data protection laws, Brazil seems to still fall short in this area. On Wednesday (April, 29), the Brazilian president signed the Provisional Measure 959, which delayed the entry into force of the Brazilian Data Protection Law (Lei Geral de Proteção de Dados Pessoais – ‘LGPD’). Due to the COVID-19 situation, this law, that was supposed to come into force on August, 2020, will only become applicable on May, 2021. The intention to postpone the applicability of the LGPD was previously manifested on the bill 1179/2020, which proposed that the LGPD should only come into force as of January, 2021, though its sanctions would become applicable as of August, 2021. This bill is still pending.
In Brazil, a provisional measure has the same effects of a law. However, according to Brazil’s legislative process, the provisional measure still needs to be approved by the Brazilian Congress, which would normally have a maximum of 120 days to approve, amend or reject it. Thus, during this period, the provisional measure is not yet permanent. Exceptionally, during this COVID-19 situation, the Brazilian Congress has approved a simplified process for the appreciation of any provisional measures, which now must happen within 16 days. This timeframe can be extended by the President of the Congress, if the Congress cannot observe the simplified process, in which case, the timeframe of 120 days would still apply.
Some argue how costly it is for companies to comply with the rules of the Brazilian data protection law and that there is a lack of clarity with the law due to the fact that the Data Protection Authority (‘ANPD’) has not yet been established. However, one must also consider that, especially now in the context of COVID-19, data protection is more relevant than ever. Surveillance measures are being more and more employed by the government and by companies. The use of technology, algorithms and artificial intelligence also became vital to fight COVID-19. Similarly, the increasing use of online platforms has also been instrumental to keep the economy active.In this context, the civil liberties are in a position of great risk.
Thus, a clear conflict seems to have been established. On the one hand, having the LGPD already in place would contribute to secure the data subjects’ fundamental rights and would also allow the sharing of data with the European Union and other jurisdictions that require an ‘adequate level of protection of personal data’. On the other hand, it would also imply on several costs for companies to comply with it soon (as it was supposed to come into force in August, 2020) and it would require a prompt establishment of the ANPD to clarify and enforce the applicability of the LGPD. In short, regardless of when it will come into force, it is undeniable that the LGPD is urgent to improve the protection of individuals’ fundamental rights and also will be instrumental to restructure businesses in this crisis scenario.
