An Uncertain Date: Preparing for the LGPD to Take Effect

As businesses prepare for the Brazil General Law for Data Protection, or LGPD, one key provision is still up in the air: the date the law takes effect.  Under the original law, the LGPD was scheduled to take effect next Sunday, August 16.  For the past several months, however, that date has been a moving target.

In early April, we reported that the Brazil Senate unanimously approved a bill that would delay the LGPD’s implementation to January 2021 and enforcement of fines and penalties until August 2021.  That bill was never approved by the House.  Later that same month, however, the Brazilian president issued Provisional Measure No. 959/2020, which postponed the LGPD’s effective date to May 2021, nearly a year later than the originally scheduled effective date.

While the Provisional Measure could delay the LGPD’s implementation, it is not the final word on the matter.  Under Brazilian law, the National Congress must ratify the Provisional Measure by August 27 of this year.  If the legislature does not approve the order, then the Provisional Measure will expire, and the LGPD’s effective date will retroactively revert to the originally scheduled date of August 16, 2020.  (Complicating matters further, the National Congress separately passed, and President Bolsonaro signed into law, a bill postponing the date of the LGPD’s enforcement until August 2021.)

Since President Bolsonaro issued the Provisional Measure, various legislators and stakeholders have floated competing proposals to modify the LGPD’s implementation date.  The debate appears to divide roughly into two camps: those who support reverting the effective date to August 16, 2020, and those who call for postponing the date of implementation until 2021.  Last week, the rapporteur for Provisional Measure No. 959/2020 weighed in, recommending that the LGPD take effect in August 2020 rather than next year.  Legislators have indicated that they may seek to approve an amended version of the Provisional Measure, under which the LGPD would also take effect this August.  Brazilian trade and industrial associations, meanwhile, continue to push for the implementation date to be postponed to next year.  A legislative session to vote on the Provisional Measure will likely be held in the coming weeks.

The ongoing debate has created significant challenges for companies preparing for the LGPD.  Some of the LGPD’s provisions, such as its requirements for the processing of sensitive data and automated decision making, may require the development of new tools or processes weeks or months before the law takes effect.  Even provisions that may not involve substantial engineering effort, such as updates to a company’s terms or third-party contracts, could involve a significant investment of resources and personnel.  In the face of continuing uncertainty, companies must weigh the costs of seeking to comply by August 16 against the risks of waiting for further clarity from the Brazilian government.

An Uncertain Date: Preparing for the LGPD to Take Effect posted first on https://centuryassociates.blogspot.com/