Provisional Measure No. 869/18 Creates The Brazilian Data Protection Authority And Amends Several Articles Of The Brazilian General Data Protection Law

On May 28, 2019, Provisional Measure No. 869/18 was approved by the Brazilian Chamber of Deputies, promoting amendments to several articles of the Brazilian General Data Protection Law (in Portuguese, Lei Geral de Proteção de Dados - LGPD - Law No. 13,709/2018), enacted in August 2018; and created the Brazilian Data Protection Authority (Autoridade Nacional de Proteção de Dados - ANPD). On the following day, on May 29, 2019, the Provisional Measure was transformed into Conversion Bill No. 7/2019, as a result of the alterations made in the Chamber of Deputies, being also approved in the Federal Senate.

In Conversion Bill No. 7/2019, the creation of the National Data Protection Authority (ANPD) was maintained, however, its nature was determined to be transitory, and it may be transformed by the Executive Branch, within two (2) years, into an entity of the Indirect Public Administration, subject to a special autarchic regime and linked to the Presidency of the Republic. The structure given by MP 869/2018 to the ANPD was, therefore, preserved.

In addition to the creation of the ANPD, the Conversion Bill also maintained the deadline for the LGPD to enter into force as of August 2020.

The main changes brought by Conversion Bill No. 7/2019 are:

The Data Protection Officer (DPO), who previously had no qualification requirements, must now have legal and regulatory knowledge, as well as the ability to provide specialized data protection services An economic group may appoint a single DPO for companies of the same economic group, provided that access is facilitated. The ANPD will define the cases in which operators (data processors) must also appoint a DPO as in the original text of the LGPD only controllers had such obligation. In the original text of the Provisional Measure No. 869/18, the possibility for a natural person to review decisions made on the basis of automated processing is no longer accepted. However, the Conversion Bill disposed that the ANPD will regulate such situations based on the nature and size of the entity or the volume of data processing operations, establishing the situations in which the review will be made by a natural person. The Conversion Bill provides that in cases of unauthorized access or individual leaks there may be a direct conciliation between the controller and the data subject and, only if there is no agreement, the controller will be subject to the penalties of the LGPD. New penalties to be applied by the ANPD...