How an improbable succession of normative acts caused emotions and uncertainty for those preparing themselves for the implementation of the LGPD.
AUTHORS: LEONARDO PALHARES AND LARISSA DA COSTA ANDRADE
The Brazilian General Data Protection Act (Law No. 13.709/2018) or LGPD (“LGPD” or “Law”) was the result of close to 10 years of legislation and was celebrated by the near majority of Brazilians when finally approved: at last, Brazil had a legal protective regime respecting the privacy of data and the data-based economy would have an objective and robust parameter to orient business and investment development.
But little did they know that crucial aspects regarding its content were far from being resolved on the Tupiniquim soil. As if following the screenplay of a cinematographic thriller, the entering into effect of the LGPD still awaits final chapters of emotion.
I – SUCCESSIVE CHANGES TO THE DATES OF ITS TERM
In its original text, the Law would enter into effect in February 2020. However, in July 20191 the date of its entering into effect was postponed until within August 2020, its clauses referring to the creation of a National Data Protection Authority (“ANPD”) being maintained as immediately effective. But the absence of coordination in its respect by the Executive Power and the delay to the formalizing and operationalizing of the ANPD, indispensable for the orientation and control of the application of the Law, together with the chaos generally resulting from the Pandemic, made necessary and unavoidable a new postponing of the date the LGPD would enter into effect.
This was brought about by Provisional Measure 959/2020 when, within the language of the last clause to a Provisional Measure regarding the exemption of the government-owned Caixa Econômica Federal bank and the government majority-owned Banco do Brasil from bidding relative to the payment of Pandemic-related emergency measures,2 the date of the coming into effect of the LGPD and the applicability of its sanctions was rather artfully extended to May 3, 2021.
Well, what appears to have been finally resolved gained new twists of emotion when at the end of May 2020, Bill No. 1179/2020 was approved by the two houses of the National Congress, changing the effective date for the application of LGPD penalties for within August 2021 but not modifying the date the Law would enter into effect and maintaining its original text.
In other words, the LGPD thus ended up having a foreseen date it would enter into effect different from that on which its penalties would enter into effect and, further, with the possibility of change to the date of its taking effect from one day to the other in the case Provisional Measure 959/20 was not adopted.
A confusing situation that is best explained below.
II – DIFFERENT SCENARIOS FOR THE ENTERING INTO EFFECT OF THE LGPD
Uncertainty being posited, there are two possibilities:
(i) Present Day Scenario: LGPD will enter into effect on May 3, 2021 and its penalties will only be able to be applied as of August 2021. According to the general rule concerning Provisional Measures, Provisional Measure 959/2020 has immediate effect and extends to May 3, 2021 the entering into effect of LGPD, whereas under Bill No. 1179/2020, given that it is a subsequent norm, extends the effective date of the penalties to within August of the same year.
However, for this scenario to occur, the National Congress would need to validate Provisional Measure 959/2020 within 120 days (by the end of August 2020) or the Provisional Measure will otherwise expire and lose its effect, which would result in the below Possible Scenario.
(ii) Possible Scenario: Provisional Measure 959/20 is not recognized by Congress and expires, the “original” date of entering into effect of the LGPD3 would return to being within August 2020. Should the National Congress not approve of the date or reject Provisional Measure 959/2020, the date for the coming into effect of the LGPD that would be May 3, 2021 would return to being within August 2020, which in practical terms would result in the Law being effective immediately.
What is most serious is that there cannot be common consensus as to which scenario would be impact free as the penalties can only be applied in August of the following year. Even if the administrative-nature penalties were suspended, the principles of and strict compliance with the LGPD could, thus, be required, i.e., Brazilians and diffuse rights defense entities would be enabled to apply the content of the LGPD, under otherwise penalty of indemnification and other sanctions of a civil nature.
III – SO WHAT CAN ONE DO?
For those bound by the LGPD there remains a choice and a bet:
(a) Pray for the approval of Provisional Measure 959/2020 and concretizing of the date for the entering into effect of the LGPD as May 3, 2021, which would grant all more time to prepare internally and await ANPD for clarification of points of law that remain grey area, or
(b) Be conservative and understand the uncertain political situation that Brazil is now facing to as of now implement all of the rules foreseen in the PGPD, avoiding that the Hollywoodian script imposed does not otherwise result in everyone becoming the victims of a horror movie.
Authors: Leonardo Palhares and Larissa da Costa Andrade