Bolsonaro orders postponement of Brazil’s data protection law
Brazil president Jair Bolsonaro has issued a provisional measure that delays the enforcement of the country’s new general data protection law until May 2021.
Wednesday’s provisional measure went into effect immediately, but still requires the approval of Congress to become permanent. Bolsonaro’s order is the second measure designed to delay the LGPD, joining a coronavirus emergency response bill that has passed the Senate but still requires further approval from the country’s House of Representatives.
VMCA partner Marcela Mattiuzzo in São Paulo said confusion remains about the implementation date of the new law. “It adds another element to the mix, but does not definitively answer when, or even if, [LGPD] will be postponed,” she said. “It is still possible that the [covid-19 emergency response bill], currently at the House, will move faster and end up prevailing. In any case, Congress will play a big part in determining the outcome.”
Veirano partner Fábio Luiz Barboza Pereira told GDR that he thinks the duelling measures create added uncertainty for companies that are trying to plan for the LGPD. Bolsonaro’s order would delay the law until 3 May 2021, while the congressional bill would delay penalties until August 2021. Pereira said a recent survey showed that only 16% of companies in Brazil think they’re ready to be compliant with the LGPD.
The lack of data protection legislation also erodes civil liberties at a time when companies and governments are increasing surveillance measures, said Ana Frazão, a professor of civil and commercial law at the University of Brasilia.
“The pandemic only exacerbates the urgency of such protection, insofar as it allows the use of technologies to track people in an effort to contain the spread of the disease,” said Frazão. “Such technologies can pose serious risks to citizens if they are implemented without due security, transparency and concern for the protection of personal data.”
Some businesses had called for a postponement before covid-19 became a global pandemic, arguing that there was a lack of clarity with the law because the government has not yet appointed a data protection authority.
However, law enforcers have urged the government to not delay the law. The Federal Public Ministry – a body similar to the US Department of Justice – released a technical note to the Brazilian Senate’s emergency coronavirus bill earlier in April, arguing that a postponement would damage the country’s reputation.
The ministry said postponing the LGPD would hinder data sharing with the EU and other jurisdictions. It supported the delay of sanctions due in large part to the country’s data protection authority still not being established, but added that the agency needs to be established immediately.