Updated after presidential sanction.
After over eight years of legislative debates, the plenary of the Brazilian Federal Senate unanimously approved, as of July 10, 2018, the Brazilian personal data protection regulation, or “LGDP” for its acronym in Portuguese (Bill of Law 53/2018), which currently awaits for Presidential signing (or veto) within the next 15 business days. Once signed, the LGDP will take effect 18 months after publicized in the Brazilian official gazette. Considering that data protection legislation was already part of Europe’s daily activities prior to is General Data Protection Regulation “GDPR” – which provided for a two year window for necessary adaption before coming into full effect – the 18 month adaption period provided by the LGDP may reveal itself rather limited. Fines up to R$ 50.000.000,00 may be applied in case of infringement, among others administrative sanctions and damage compensation.
Brazil will soon occupy a relevant role in the international data protection scenario for two main reasons: (i) the LGDP provides for an extraterritorial reach of its provisions (ii) by providing data subjects and private sector companies with greater legal certainty, which will consequently attract more investment into the national digital economy.