6/30/2020
Watch out! When LGPD is effective, while the Brazilian National Data Protection Authority (ANPD) is not allowed to apply sanctions for LGPD violations, the Judiciary and Sectorial Governmental Authorities will not have its hands tied.
On June 12, 2020, Law No. 14.010/2020 was approved and, amid emergency measures for combating the COVID-19 pandemic, it postponed the enforcement of LGPD’s administrative sanctions to August 1st, 2021.
Currently, while Provisional Measure No. 959/2020 awaits to be voted by the National Congress, the substantive provisions of LGPD are set to be enforced as of May 3rd, 2021. If the Provisional Measure No. 959/2020 is rejected by the National Congress, the provisions will be enforceable as of August 15, 2020.
Regardless of the date in which the substantive provisions of LGPD become enforceable – August 15, 2020 or May 3rd, 2021 – the future reserves a period of LGPD substantive provisions enforceable without sanctions for violations. Amid the consequences of this legal framework, we highlight that even after the Brazilian National Data Protection Authority (ANPD) is established, it will not be able to determine sanctions for LGPD violations before August 2021. However, the Judiciary and sectorial governmental authorities’ respective competences will remain untouched and will not face the same restrictions. This phase, therefore, asks companies subject to LGPD for caution and planning.
The Judiciary, facing demands from personal data subjects whose rights were not fulfilled will be able to, for example, determine that the company facing a legal suit fulfill the personal data subject’s rights within a determined deadline under penalty of coercive fines, besides fines in accordance with the Brazilian Civil Procedure Code, to enforce the obligation.
Likewise, consumer rights authorities will be able to start administrative suits to investigate alleged consumer rights violations regarding its personal data and set penalties in case the violations are confirmed.
Although the extension of the period between the enforcement of the obligations and the respective sanctions for violations established by LGPD – to be enforced by the ANPD – it is recommended that companies do not stop seeking compliance with LGPD, mainly in regard to the fulfillment of personal data subjects’ rights over the processing carried out. The COVID-19 pandemic certainly incentivized other priorities on the corporate routine. However, the data protection field is among the most impacted by the current demands, including suits that have already been filed to Brazilian High Courts.
Coauthors: Esther Jerussalmy Cunha, Fabrício Bertini Pasquot Polido e Ricardo Luis Fernandes da Silva
