Brazilian General Data Protection Law

Brazilian General Data Protection Law
Name	Lei Geral de Proteção de Dados Pessoais
Native name	Lei nº 13.709/2018
Enacted by	National Congress of Brazil
Enacted	2018
Citations	Lei nº 13.709
Status	in force

Brazilian General Data Protection Law

The Brazilian General Data Protection Law was enacted as Lei nº 13.709/2018 to regulate personal data processing and establish privacy standards across Brazil. It aligns national practice with international instruments such as the European Union–Mercosur Free Trade Agreement discussions and echoes principles in the General Data Protection Regulation of the European Union. The law created institutional mechanisms and individual rights intended to harmonize practices across sectors including finance, health, telecommunications, and digital platforms.

Background and Legislative History

Debate over the statute drew on precedents from the European Union, comparative proposals from the United States privacy model, and regional initiatives influenced by the Organization of American States and the United Nations General Assembly resolutions on privacy. Key legislative actors included the National Congress of Brazil, the Chamber of Deputies of Brazil, and the Federal Senate of Brazil, with executive input from the Presidency of Brazil and regulatory proposals influenced by the Brazilian Internet Steering Committee and civil society organizations such as InternetLab and Access Now. Judicial interpretation has involved the Supreme Federal Court of Brazil and has intersected with litigation involving entities like Banco do Brasil and Telefônica Brasil. Implementation timelines were adjusted through measures by the Ministry of Justice (Brazil), executive provisional measures, and engagement with the Brazilian Association of Information Technology and Communications Firms.

Scope and Key Principles

The statute applies to processing carried out in Brazil, processing aimed at offering or providing goods or services to individuals in Brazil, and processing of personal data by entities established in Brazil. Principles codified in the law mirror international instruments such as the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data and include purpose limitation, necessity, transparency, and data quality, drawing doctrinal influence from cases adjudicated by the European Court of Human Rights and norms advocated by Privacy International. Special categories for sensitive personal data reflect protections comparable to those in the Health Insurance Portability and Accountability Act debates in the United States Congress and privacy frameworks discussed at the World Health Organization.

Rights of Data Subjects

The law grants data subjects rights similar to those in the General Data Protection Regulation and rights articulated in human rights instruments like the Universal Declaration of Human Rights and the American Convention on Human Rights. Rights include confirmation of processing, access, correction, anonymization, portability, deletion, and objection, as well as the right not to be subject to automated decision-making absent safeguards, which has been debated in contexts involving Facebook, Google, Amazon (company), and financial institutions like Itaú Unibanco. Collective rights have been raised by organizations such as Procon-SP and civil society actors including Instituto Brasileiro de Defesa do Consumidor.

Obligations of Controllers and Processors

Controllers and processors must implement technical and organizational measures, maintain processing records, conduct data protection impact assessments, and appoint a data protection officer where applicable. These obligations affect sectors represented by Confederação Nacional da Indústria, Associação Brasileira de Bancos, and technology firms such as Mercado Livre and TOTVS. Contractual relations with international processors implicate entities like Microsoft, Oracle Corporation, and IBM when engaging in cross-border transfers, which may require standard contractual clauses similar to those developed by the European Commission and adopted in dialogues with the International Organization for Standardization.

Enforcement, Sanctions, and Regulatory Authority

The law established the National Data Protection Authority as the primary regulator, with powers to investigate, impose administrative fines, and issue guidance. Enforcement actions and fines can be levied against companies including multinationals and domestic firms, and have been compared to enforcement practice by the Information Commissioner's Office and the Commission Nationale de l'Informatique et des Libertés. Sanctions range from warnings to substantial fines and publicity orders; parallel litigation may proceed in the Superior Court of Justice (Brazil) or the Supreme Federal Court of Brazil. International cooperation has been pursued with regulators such as the European Data Protection Board and authorities in Argentina and Chile.

Implementation, Compliance, and International Impact

Compliance efforts involve updates to corporate governance, cybersecurity practices, and contract law in sectors overseen by the Central Bank of Brazil, National Health Surveillance Agency (Brazil), and the National Telecommunications Agency (Brazil). Certification schemes and standards bodies like the International Organization for Standardization and the ABNT have been engaged to develop compliance frameworks. The law has influenced trade negotiations with blocs such as Mercosur and discussions with the European Union about data adequacy, affecting multinational corporations including Facebook, Google, Microsoft, Apple Inc., and regional platforms like Nubank. Academic and policy analysis has come from institutions such as the Getulio Vargas Foundation, Fundação Getulio Vargas, and University of São Paulo, shaping evolving jurisprudence and business practices.

Category:Law of Brazil