Brazilian Data Protection Law and Its Impact on Compliance

The data protection law was largely inspired in the European General data protection regulation (GDPR)’s model, but it has some tropical particularities.

After 8 years in the National Congress, Brazil now relies on a specific law for the protection of personal data (Law No. 13,709 of August 14th, 2018 - the “Data Protection Law”). The Data Protection Law was largely inspired by the European General Data Protection Regulation (GDPR), but it has some tropical peculiarities.

Despite Law No. 12,965/2014 (Brazilian Civil Rights Framework for the Internet), Brazil did not have rules specifically regarding personal data protection, but only punctual (e.g. credit protection) or self-restrained rules imposed by companies in their own privacy policies.

In this sense, following the recent polemics involving Facebook and the use of personal data to analyze and influence individual behavior patterns, the National Congress expedited rulemaking process and finally passed Law No. 13,709/2018. The Data Protection Law was subject to 5 presidential vetoes and it was amended in key aspects by the Provisional Measures No. 869, of 2018, approved on May 29, 2019. It will come into force within 18 months.

The guiding principle of Brazil’s Data Protection Law is the data subject’s consent to any “processing operation”1, especially in case of sensitive data (e.g. health). This consent cannot be generic or camouflaged in broad or imprecise clauses. Consent must also be expressed in writing or any other means which demonstrate the willingness of the data subject, but it is being up to the controller to prove that the consent was given. If there is a change in the purpose of data use that is incompatible with the original consent, the controller must inform the data subject, who can revoke the consent previously given at any time. For personal data to be shared with other controllers, there must be an expressed consent of the data subject as well.