LGPD sanctions postponed until August 2021

Brazilian coronavirus relief legislation has gone into effect, postponing the penalties for violations of the landmark LGPD until August 2021.

It’s still not clear when the data privacy law will come into force. The coronavirus relief package that was published as a final law today has a start date of August, as originally planned.

However, there remains the matter of Brazil president Jair Bolsonaro’s provisional measure that delayed the LGPD until May 2021. Congress has an August 2020 deadline to reject or change the language of Bolsonaro’s order. If Congress does nothing, the order will lapse and LGPD will come into force in August.

Palhares partner Felipe Palhares in São Paulo said: “Congress has some inclination to reject the provisional measure”. Veirano partner Fábio Pereira agreed, telling GDR that the “most likely scenario” is LGPD going into force this August with sanctions postponed for a year.

However, Palhares warned that nothing is certain in today’s political climate. “No one knows. All dates that have been raised are still a possibility,” he said.

Indeed, the dates for LGPD were changed numerous times in less than two months while the coronavirus legislation made its way through Congress.

The Senate initially voted in April to postpone LGPD until January, with sanctions postponed until August 2021. Brazil’s lower house then voted last month to remove the delay of LGPD's commencement, but to keep the sanctions delay intact.

Later in May, some senators pushed to reinstate the delay of LGPD to January, but that measure was rejected.

In a bizarre twist, one of the factors that spurred the Senate to support the original August timeline was a misunderstanding of what the LGPD does, Palhares said.

During deliberations on the bill on 19 May, Senator Weverton Rocha repeatedly called for his colleagues to vote for the LGPD to go into effect this August because he said the country needs to combat “fake news”. Rocha also said he was not interested in poring over the details of the law.

The LGPD does not regulate fake news.

“Congress does not understand a lot about the law,” Palhares lamented when speaking with GDR. Despite the misunderstanding, most Brazilian privacy attorneys are happy that LGPD should come into force as originally scheduled. Even though sanctions are postponed, the law can still be enforced via its private right of action, Palhares noted.

“If that is the case [that LGPD comes into force this August], we are extremely satisfied with the outcome as Brazil is an urgent need of a comprehensive data protection law,” said Pereira. “We also hope the period of time between now and August 2021 is used wisely by private entities and public bodies to make themselves compliant with the new regulation.”

Get unlimited access to all Global Data Review content