On August 14, 2018, the Brazilian Congress enacted a full-fledged data protection bill, called Brazilian General Data Protection Law (“LGPD” in Portuguese). The bill initially foresaw an 18-month adaptation period. However, the extension of such adaptation period was approved by the Brazilian Government, thus, the bill will come into effect after 24 months, in August 2020, and companies will have until then to adapt their internal procedures to LGPD standards.
Inspired by the European General Data Protection Regulation “GDPR”, the LGPD creates a new legal framework for the use of personal data in Brazil, both online and offline, in the private and public sectors. In addition to heightening the protection of individual rights, the LGPD aims to encourage the sustainable development of the economy and the businesses, based on the best international practices. By having a General Data Protection Law, Brazil enters the list of approximately 120 countries that today may be considered to have an adequate level of protection of privacy and the use of personal data.
The non-compliance with LGPD terms can lead to penalties including administrative penalties, fines, blocking or eliminating the personal data object of the breach or even publishing the breach, making it known. Fines may vary from 2% of the company’s, group’s or conglomerate’s revenue in Brazil in its last fiscal year, limited in total to BRL 50 million per infraction. There is also the possibility of a daily fine to compel the entity to cease violations.
When applying penalties, it will be assessed whether the company adopts measures aimed at processing personal data safely and adequately, in a manner that minimizes damages and also the existence and application of good privacy practices and policies.
In this regard, companies will have to demonstrate compliance and responsibility with the laws in force, in order to increase the level of trust of all their stakeholders, suppliers, consumers, and commercial partners. The protection of personal data should be seen not as a cost, but as a market differential. Adaptation to a near future regulation is an investment and a competitive advantage.
Patrícia Perinazzo C. Medeiros is a lawyer in the intellectual property and data protection area at PNST Advogados.
