Brazilian Government Makes the LGPD Effective Imminently

On August 14, 2018, the Brazilian government approved the Brazilian General Data Protection Law, known as the Lei Geral de Proteção de Dados Pessoais (“LGPD”). Enforcement was set to begin on August 15, 2020 but then, due to COVID-19 was delayed until May 2021. Later, the delay was shortened to December 31, 2020, but eventually overturned by the Brazilian Senate, reverting to the original enforcement date resulting in the LGPD coming into effect very soon. Notwithstanding the immediacy of the LGPD, penalties and sanctions for non-compliance provided therein will not be enforced until August 1, 2021.

The LGPD, like the EU’s General Data Protection Regulation (“GDPR”) is extraterritorial in scope. The LGPD applies to any company, public or private, that processes personal data in Brazil, collects or processes the personal data of individuals in Brazil, or processes data for the purpose of offering or supplying goods or services in Brazil. This means that it applies to any company located within Brazil, as well as those outside of Brazil that process personal data of individuals residing in Brazil or otherwise marketing goods or services to people in Brazil. Accordingly, any company located in or marketing goods or services to individuals in Brazil should be aware of the LGPD and consider whether any immediate action on becoming compliant with the LGPD is appropriate. 

With Brazil representing almost half of all IT spend in Latin America, the largest market for software outsourcing in Latin America, a sizeable workforce providing outsourced software and services, and manufacturing products like commercial airplanes and cars, many U.S. companies operate in Brazil, directly, or indirectly through joint ventures, affiliates, or outsourcing. Whether the personal data remains in Brazil or is exported back to the U.S., companies should be aware of the requirements of the LGPD.

For companies that undertook efforts to comply with the GDPR, they will find several similarities between the LGPD and the GDPR, though there are several differences between the two that are worth noting.

Requirements of the LGPD

Companies are required to appoint a data protection officer (“DPO”) to be the “channel of communication” between the financial controller, the data subjects (e.g., employees) and the National Data Privacy Agency (“ANPD”), the data protection authority created by Presidential’ s executive order. This individual is responsible for overseeing compliance efforts, as well as training, for an organization. The name and contact information of the DPO must be clearly posted on the company’s website. (Art. 41.)

The LGPD defines personal data relatively broadly, in that under the LGPD, personal data is any information that is related to an identified or identifiable individual. (Art. 5, I.). Like GDPR, this includes information that could be used to identify an individual, even if the information does not facially do so. While the LGPD takes a slightly broader approach to defining personal data, there are a greater number of categories of data that are excluded from compliance under the LGPD. Publicly available information and personal data that is processed by a natural person and used exclusively for private non-economic reasons, for journalistic, artistic, or academic purposes, or used exclusively for public security, national defense, and data processed for state security or criminal investigations or prosecution are all exempt under the LGPD. (Art. 4.) The LGPD does define a subset of personal data as “sensitive data” as personal data that relates to one’s racial or ethnic origin, religious and political views, union, religion, philosophical or political affiliations, health, sexual, or biometric or genetic data.” This sensitive data is afforded higher protections and only a subset of the lawful bases may be used to process sensitive data.

The ability of a company to process personal data, like the GDPR, requires a lawful basis for processing. The LGPD contains the same 6 lawful basis of processing as the GDPR, but also includes four additional lawful basis for processing: for the protection of life or physical safety; the protection of health in procedures conducted by health professionals or health entities (including certain sensitive personal data); as necessary for pharmaceutical care and health care in relation to data portability and transactions benefiting data subjects; or as required to protect credit. (Art. 7, I-X.).

Although the EDPB and the WP29 have provided significant guidance over the years regarding the permissibility of consent under the GDPR, the LGPD itself provides significant restrictions on the use of consent as a lawful basis for processing. Under the LGPD, consent is defined as “voluntary, informed and unquestionable manifestation under which the owner of the data agrees to its personal data processing for a specific purpose.” (Art. 5, XII.) The LGPD goes further to require that consent must be either in writing or by any other means that demonstrate the manifestation of consent by the individual with the rules described in the callout box below. 

The LGPD also provides individuals with certain rights regarding the processing of their personal data. Besides the right to be informed of the processing of their personal data through privacy notices with certain minimum content, individuals also have the right, subject to certain conditions, to access, correct, obtain a portable copy of, anonymize, and delete their personal data. Both the GDPR and the LGPD provide individuals with the right to request information about the data that is collected from them. However, the LGPD also provides an individual with the right to request information about what will happen if the individual does not grant consent to the controller in order to process their personal data. 

A company may export personal data to another country where such foreign country or organization provides adequate level of data protection or provides assurance of data protection through contractual clauses, Binding Corporate Rules (BCRs), or regularly issues codes of conduct certifications and seals. Personal data may also be exported where the data subject explicitly consents or there such export is necessary for international cooperation with intelligence, investigative, and prosecutorial agencies. (Art. 33.) It is not clear whether the ANPD will take a strict or a liberal view towards exports to the United States in light of the concerns raised in the Schrems II decision in the European Union. 

The LGPD also differs from the GDPR with respect to the processing of personal data of a minor, which, under Brazilian law defines a child as anyone below the age of 12 and an adolescent as one between the age of 12 and 18. For a child, consent must be obtained from the child’s parents or guardians. One must make a reasonable effort to verify that the consent was given by the child’s parent or guardian. With respect to the processing of any personal data of a child or adolescent, any such processing must be in their best interest and any information about the processing must be provided in a simple, clear, and accessible manner. (Art. 14.)

Like the GDPR, violations of the LGPD are potentially subject to rather significant fines. A violation of the LGPD can result in administrative sanctions, which include, warnings, fines up to two percent (2%) of a company’s revenue for the preceding fiscal year in Brazil, capped at BRL 50 million per violation. Unlike the GDPR, the calculation of the fine is based upon revenues in Brazil and not on a global basis. A company may also be subject to having their name, along with the nature of the violation, published, as well as blocking or deleting access to the personal data used in violation of the LGPD. (Art. 52).

Impacts to Businesses

Although penalties and sanctions for non-compliance with the LGPD will not be enforced until August 1, 2021, organizations that were already subject to GDPR should review their privacy policies and procedures and revise them as necessary for the LGPD. All other organizations that were not previously subject to GDPR but are subject to the LGPD should immediately adapt to it. These may include the following:

• a data mapping and data governance exercise to understand what personal data processing activities (if any) the business performs that may be subject to the LGPD; 
• identifying any gaps where the business’ processing activities do not currently comply with the requirements of the LGPD and developing a remediation plan;
• revising (or creating) any policies and procedures for compliance with the LGPD, including any policies and procedures related to complying with requests from individuals exercising their rights;
• reviewing applicable processing activities to ensure that there is at least one lawful basis for each processing;
• appointing a DPO;
• revising and adopting or reviewing the businesses’ incident response policies to ensure that they can comply with their breach notification obligations. 

Businesses should also pay close attention to any processing that involves an export of personal data from Brazil and begin to put appropriate measures in place to ensure continued protection for such personal data. 

For more information about a business’s privacy obligations under LGPD, please contact any of the authors listed below.