The Brazilian business environment with the new data protection law

The Brazilian General Data Protection Law (Lei Geral de Proteção de Dados or “LGPD”) will enter into force in about a year but, surprising as this may sound, there is a controversy as to when it will take effect. We will spare the reader the legal technicalities; it suffices to say that under the most conservative interpretation the new law will enter into force on August 15, 2020.

However far away it seems, entities or individuals that process personal data should have already started preparations to comply with the LGPD. The work begins with an assessment aimed at identifying the type of personal data processed by the entity and the respective applicable legal basis. Implementation projects, even in small companies, will not be trivial.

The LGPD is the topic of this issue of LS Brazil Outlook. The Law will affect the way of doing business not only of data-driven entities, but all industries as well as profit and not-for-profit activities. It will also determine a new approach to M&A transactions, a subject that is addressed by Daniel Tardelli.

Silvia Lira analyzes aspects to be reviewed within labor relationships – a necessary step as all entities process at least their employees’ personal data.

In the international front, there is a controversial matter related to the autonomy of the Brazilian Data Protection Authority (ANPD). The European Data Protection Regulation - GDPR – makes the free flow of personal data from the EU to other countries conditional upon a minimum level of data protection. One of the elements considered to reach this standard is the autonomy of the national authorities of the recipient country. Felipe de Paula and Camila Mariotto examine whether the recently created ANPD is adherent to the European requirements in this regard.

Finally, I demystify the adequacy of appointing consent as the “stronger” and preferred legal basis to process personal data, among many others provided for in the law. Choosing the right legal basis in each specific case is the biggest challenge in interpreting and applying the LGPD, as some legal basis may result in undesirable consequences.

Enjoy your reading,