Brazil’s General Data Protection Law

In their latest bid for order and progress, Brazil passed the Lei Geral de Proteção de Dados (LGPD) or the General Law for the Protection of Personal Data. The legislation is a way to protect Brazilian citizens' personal information and privacy by providing guidelines on how that data can be processed and collected by organizations. (Hint: Only with permission.) It helps standardize and clarify over 40 different previous, (sometimes conflicting) statutes that regulated personal data, and applies to both Brazilian and international businesses and organizations.

Terms to know for LGPD Brazil 

• Personal Data: Any information that identifies or is specific to an individual, like their name, last name, nickname, ID number, etc.
• Data Holder or Data Subject: The individual the personal data is about.
• Data Processing: Any operation carried out using personal data, like collecting, storing, using, or disclosing information.
• Data Controller: The person responsible for decisions about how personal data is used or processed. They are ultimately liable for their company's fulfillment or failure to meet LGPD standards.
• Consent: free, informed permission or agreement. In this case, the data holder’s permission for their information to be processed for a given purpose.
• Autoridade Nacional de Proteção de Dados (ANPD) or National Data Protection Authority: Branch of the Brazilian federal government tasked with overseeing the regulation, compliance, and enforcement of LGPD.
• Data Protection Officers: Person representing the organization that processes personal data, who is responsible for communication between their business, the ANPD, and data holders. They typically have a background in law or IT.

What the LGPD does 

The LGPD requires Data Controllers to adopt technical and administrative practices that regulate how and why personal data can be processed (electronically or physically,) and to protect the personal data they process from unauthorized access, loss, alteration, and/or exposure.

Ten rights of data subjects

Brazil's LGPD outlines ten rights of data subjects, which are the foundation for all the processing requirements made of businesses or organizations:

1. The right to confirm that their data was processed;
2. The right to access their data;
3. The right to correct incomplete, inaccurate or out-of-date data;
4. The right to anonymize, block, or delete unnecessary or excessive data or data that is not being processed in compliance with the LGPD;
5. The right to move their data to another service or product provider;
6. The right to delete personal data processed with their consent;
7. The right to information about public and private third parties with which the controller has shared their data;
8. The right to information about what happens if they deny consent;
9. The right to revoke their consent.
10. The right to data portability, allowing the holder to request a complete copy of their data in a format usable by competitors.

Requirements for data controllers/organizations

LGPD requires data controllers/organizations to:

• Appoint a Data Protection Officer to manage requests or complaints from customers whose identity and contact information is public and clear, preferably on their website;
• Keep a record of the processing operations they carry out;
• Inform, correct, delete, anonymize, or move personal data as the data subject requests;
• Remove data once the relationship ends;
• Put administrative and security measures in places to protect data security from theft, unauthorized access, accidents, or other issues;
• Deliver any data breaches to data subjects, local authorities, and the ANPD.

There are ten bases under which companies can legally process personal data. Data can be processed:

1. For legitimate, specific, and explicit purposes that the data subject has agreed to;
2. To comply with a legal or regulatory obligation;
3. To execute public policies based on legal contracts, agreements, or similar;
4. To execute a contract at the request of the data subject (like a purchase or transaction);
5. For carrying out research, and ensuring whenever possible that personal data has been anonymized;
6. For the exercise of rights in judicial, administrative, or arbitration procedures;
7. For the protection of life or physical safety of the data subject or a third party;
8. To protect health, as carried out by health professionals or health entities;
9. When necessary to fulfill the legitimate interests of the controller or a third party;
10. For the protection of credit.

What the ANPD does 

The Autoridade Nacional de Proteção de Dados (ANPD) or National Data Protection Authority is the to-be-formed branch of the Brazilian federal government tasked with overseeing the regulation, compliance, and enforcement of LGPD. While under the direction of the president, the ANPD does have decision-making powers. It will consist of a 28 member advisory board broken into several groups: the Board of Directors, the National Council, an Internal Affairs Office, and other specialized units for legal and enforcement tasks.

They will be responsible for:

• Providing interpretation and practical guidelines for how to implement LGPD;
• Investigate and audit complaints or breaches reported and work with the Data Protection Officer on a resolution;
• Issue sanctions for data processing violations;
• Conduct studies, public debates, and hearings about the protection of personal data.

When the LGPD went into effect 

The law will become effective on January 1, 2021.

LGPD compliance violation sanctions have been postponed until August 1, 2021.

Recommendations 

• First and foremost, waiting until the last minute to get compliant could be a costly mistake. Non-compliance could result in fines upwards of 2% of their revenue in Brazil, for the prior fiscal year, to a max of 50 million Brazilian reais per infraction (roughly 12.9 million USD or 11.2 million EUR.)
• Appoint a Data Protection Officer to monitor data processing and security, and clearly publish their name and contact information on your website.
• Always ask for consent. Be clear and transparent with how and why customer data is being processed, and make it easy to opt-in or out.
• Only store data as long as is needed to process a transaction, and no longer.
• Be sure to document your entire processing pipeline: how are you collecting, storing, using, and sharing personal data? You could be called upon to present that documentation, so better to have it prepared.
• Schedule regular audits. Data leaks are enormously costly in resources and reputation. Being on the lookout will enable you to catch errors or predators faster, and being proactive always looks better than getting caught.

More info 

• Official LGPD website

Frequently asked questions