General Data Protection Law comes into effect in September

On August 26, the section that postponed the coming into effect of the LGPD was considered void at the Senate’s voting session. The members of the house argued that this matter had already been decided by the Congress, and therefore, should not be subject to a second review.

The Senate released a press statement informing that “the LGPD will only come into force after the President’s signature on the other provisions set forth by the PD”, in accordance with the Brazilian Constitution. The final provisions on the matter voted by the Senate have been sent to the President, who has until September 17 to sign the PD. If the President does not examine it within this timeframe, the bill will be tacitly approved.

Therefore, as soon as the LGPD comes into effect, individuals will have the right of action and consumer protection bodies and public prosecution offices may also enforce some of its provisions in matters related to consumer protection and data subject’s rights.

It is important to note that there were no amendments regarding the deadlines to enforce administrative sanctions. In this sense, the sanctions resulting from non-compliance with the LGPD will be applicable as of August 1st, 2021.

Also, on August 26, 2020, the President enacted a decree that regulates the governance structure of the Brazilian Data Protection Authority (ANPD).

Among other provisions, the decree restates that the enforcement of the sanctions provided for by the LGPD is under the ANPD’s discretion and exclusive jurisdiction over personal data matters. Besides, the decree also sets forth the responsibilities of the board of directors and other bodies that are part of the ANPD.

This decree is effective as soon as the President & Managing Director of the ANPD is named. This means that at any moment now the ANPD could start operating.