Brazil’s LGPD To Take Effect In September

Written by: Charles R. Langhorne IV, Esq.

In a wild turn of events over a few days at the end of August, Brazil’s Lei Geral de Proteção de Dados Pessoais (“LGPD”) will take effect on September 16, 2020, barring a presidential veto or another act of the Brazilian legislature.

What is the LGPD?

The LGPD is Brazil’s national data privacy legislation that is very similar to the European Union’s General Data Protection Regulation (“GDPR”). It imposes data protection obligations on businesses that process the personal data of Brazilian citizens. Similar to the GDPR, the LGPD provides an extremely broad definition for “personal data,” a trend we expect to continue as countries continue to pass data privacy legislation. Even if the GDPR or the LGPD do not apply to your company’s operations, this is something to take note of because it is only a matter of time before it becomes applicable to a country in which you do business.

When Was It Supposed To Take Effect?

The LGPD was originally supposed to take effect on August 15, 2020. We have been following the COVID-19 impact to the LGPD since June when Brazil’s president issued an Executive Order, Provisional Measure No. 959/2020, delaying the effective date until May 3, 2021.

What Happened At The End of August?

On August 25, 2020, Brazil’s House of Representatives approved a modified version of Provisional Measure No. 959/2020 which would have made the LGPD effective as of December 31, 2020.

On August 26, 2020, Brazil’s Senate approved Conversion Bill No. 34/2020 which originated from Provisional Measure No. 959/2020, which had been approved by the House of Representatives just one day earlier. However, due to a procedural issue, Article 4, the section that delayed the effective date until December 31, 2020, was removed. Which left the privacy industry to wonder, with no delayed effective date in the Conversion Bill, did the LGPD take effect on August 15, 2020?

On August 27, 2020, the Brazilian President approved a regulatory structure for the nation’s data protection authority, the Autoridade Nacional de Proteção de Dados (“ANDP”). This was the last hurdle to clear before the LGPD could go into effect.

Delayed Sanctions

On June 12, 2020, Brazil passed legislation delaying the enforcement of the LGPD until August 1, 2021. However, this does not prohibit lawsuits from being brought for damages and indemnity.

Conclusion

Now that all boxes have been checked for the LGPD to go into effect, unless the Brazilian legislature or the Brazilian President change course, it is likely the LGPD will go into effect on September 16, 2020.