The General Personal Data Protection Law ( pt, Lei Geral de Proteção de Dados Pessoais, or LGPD; Lei 13709/2018), is a

statutory law Statutory law or statute law is written law passed by a body of legislature. This is opposed to oral or customary law; or regulatory law promulgated by the executive or common law of the judiciary. Statutes may originate with national, state ...

data protection Information privacy is the relationship between the collection and dissemination of data, technology, the public expectation of privacy, contextual information norms, and the legal and political issues surrounding them. It is also known as da ...

and

privacy Privacy (, ) is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively. The domain of privacy partially overlaps with security, which can include the concepts of a ...

in the

Federative Republic of Brazil Brazil ( pt, Brasil; ), officially the Federative Republic of Brazil (Portuguese: ), is the largest country in both South America and Latin America. At and with over 217 million people, Brazil is the world's fifth-largest country by area an ...

. The law's primary aim is to unify 40 different Brazilian laws that regulate the processing of

personal data Personal data, also known as personal information or personally identifiable information (PII), is any information related to an identifiable person. The abbreviation PII is widely accepted in the United States, but the phrase it abbreviates ha ...

. The LGPD contains provisions and requirements related to the processing of personal data of individuals, where the data is of individuals located in Brazil, where the data is collected or processed in Brazil, or where the data is used to offer goods or services to individuals in Brazil. The LGPD became law on September 18, 2020 but its enforceability was backdated August 16, 2020.

Sanctions A sanction may be either a permission or a restriction, depending upon context, as the word is an auto-antonym. Examples of sanctions include: Government and law * Sanctions (law), penalties imposed by courts * Economic sanctions, typically a b ...

under the regulation will only be applied from August 1, 2021. The national data protection authority responsible for enforcement of the LGPD is the , or ANPD.

The LGPD contains sixty-five articles and defines new legal concepts in Brazilian law, such as ''personal data'' and ''sensitive personal data''. The law sets out the rights of the subjects of personal data, and under what conditions that data can be collected, processed, stored, and shared. It also specifies the obligations of the entity processing that data, and the exceptions to the law. In Article 18, the LPGD allows the data subject right to do the following: # To confirm that their personal data is being processed. # To access their personal data. # To correct incomplete, incorrect or out-of-date personal data. # To anonymise, block, or delete any unnecessary, excessive, or non-compliant personal data. # To request that a data controller moves their personal data to another service or product provider. # To delete their personal data. # To be given information about how their personal data has been shared. # To be given information about their rights to not give consent to process their personal data. # To withdraw consent to process their personal data. Article 7 describes the conditions under which personal data may be processed: # With the data subject's consent. # To comply with the data controller's legal or regulatory responsibilities. # For public administration and carrying out public policies set out in law, regulation, or in contracts. # For research studies (anonymised where possible). # To carry out a contract. # To exercise Brazilian law. # To protect life or personal safety. # By healthcare or sanitation professionals, to safeguard a person's health. # For the legitimate interest of the data controller or a third party, unless that would infringe upon the data subject's statutory rights. # To protect credit ratings.

Enforcement

Article 48 of the LGPD states that the data controller must inform the national data protection authority and the data subject, if a security incident occurs that may result in relevant damage or risk, in a reasonable time period (as defined by ANPD). Article 52 states that the maximum fine for breaching LGPD is two percent of a private company's revenue in Brazil, up to a maximum of 50 million reais.

Comparison with GDPR

The process of combining separate data protection laws in to one, was inspired by the EU's General Data Protection Regulation, which was adopted on April 14, 2016. The LGPD and the GDPR have similar definitions of personal data and essentially the same data subject rights. The regulations differ on the legal basis for processing data, where the LGPD additionally includes carrying out research studies and protecting credit ratings. Additionally, the LGPD does not specify a time period in which data breaches must be reported and the penalties for breaching the LGPD are lower than that for GDPR.

Timeline

In 2015, the Brazilian Government issued the Preliminary Draft Bill for the Protection of Personal Data and submitted it to public consultation, before being sent to Congress for discussion and vote. On August 14, 2018 the Brazilian National Congress first passed the General Personal Data Protection Law. On December 28, 2018 Michel Temer issued provisional measure 869 that amended the LGPD to include the creation of a national data protection authority responsible for enforcement of the law called (ANPD). On April 29, 2020, President

Jair Bolsonaro Jair Messias Bolsonaro (; born 21 March 1955) is a Brazilian politician and retired military officer who has been the 38th president of Brazil since 1 January 2019. He was elected in 2018 as a member of the Social Liberal Party, which he turn ...

issued Provisional Measure 959 that postponed the effective date of the LGPD to May 3, 2021. On August 26, 2020 The

Chamber of Deputies The chamber of deputies is the lower house in many bicameral legislatures and the sole house in some unicameral legislatures. Description Historically, French Chamber of Deputies was the lower house of the French Parliament during the Bourbon ...

, Brazil's lower house, amended the measure to make the LGPD take effect on December 31, 2020. The Federal Senate, Brazil's

upper house An upper house is one of two chambers of a bicameral legislature, the other chamber being the lower house.''Bicameralism'' (1997) by George Tsebelis The house formally designated as the upper house is usually smaller and often has more restric ...

then decided that any postponement was void because the effective date had already been decided by congress. The LGPD passed in the Senate on September 16, 2020 and was sent to Jair Bolsonaro to sign into law on September 17, 2020. The LGPD became law on September 18, 2020 and its enforceability was backdated August 16, 2020. Sanctions under the regulation were to only be applied from August 2021.

References

{{reflist

External links

Brazilian General Data Protection Law (LGPD, English translation)

Brazilian General Data Protection Law (LGPD, English translation with navigation links)
Brazilian legislation Law in South America Data laws Data laws of the Americas Privacy legislation Internet privacy legislation

Contents

Enforcement

Comparison with GDPR

Timeline

See also

References

External links