Personal data protection recognized as fundamental right in Brazil

​On February 10, 2022, the Brazilian Congress enacted Constitutional Amendment (EC) 115, which establishes personal data protection as a fundamental right in Brazil’s 1988 Federal Constitution. EC 115 also gives the federal government exclusive jurisdiction to legislate personal data protection and processing. This amendment originates from a 2019 bill passed in the House of Representatives and Senate last year.

In elevating personal data protection to the status of a fundamental right, the Brazilian Congress recognizes the importance of data protection for individuals, an issue that has grown increasingly prominent in recent decades in light of new technology and information flows in the digital environment.

EC 115 also confirms the importance of the Brazilian General Data Protection Law (LGPD), which came into effect in September 2020 and is regarded as a significant step forward for data processing legislation in Brazil. Encompassing both physical and digital media, the LGPD is the first law in the country that specifically addresses personal data protection.

The amendment also establishes the competence of the highest court within Brazil’s judiciary, the Federal Supreme Court (STF), to adjudicate legal issues involving personal data. Until now, the STF had examined related cases based on other constitutional guarantees, such as the inviolability of intimacy and individuals’ private lives.

Brazil’s alignment with international data protection trends is also reflected in EC 115. Personal data protection is recognized as a fundamental right by numerous other democratic states and international organizations, and, as an example, is established in Article 8 of the Charter of Fundamental Rights of the European Union.

Entities that process personal data in line with Brazilian legislation are set to benefit from greater legal certainty with the passing of EC 115. By giving Brazil’s federal government exclusive jurisdiction over data protection legislation, EC 115 prevents alternative regulations on the subject from being enacted at the state and municipal level.

For further information on the new constitutional amendment, please contact Mattos Filho’s Data Protection & Cybersecurity practice area.