This afternoon, August 14th, 2018, President Michel Temer sanctioned the Brazilian General Law on Data Protection (“GLDP”), which concerns the protection of personal data and amends Law nº 12.965/2014 (Brazilian Civil Rights Framework for the Internet).

Although the complete version of the Law has not been made available yet, it suffered relevant vetoes today regarding the text that had been approved by the Senate on July 10th, the main one being the exclusion of the creation of the National Data Protection Authority (“NDPA”), on the basis that the creation of said authority by initiative of the Legislative would be unconstitutional.

The creation of the NDPA, an agency linked to the Ministry of Justice with attributions to create guidelines for the National Policy on Protection of People and Privacy Data, consisted in a substantial issue of the bill. Much of the GLPD’s provisions, such as the supervision and application of penalties foreseen in the event of misuse or leakage of data, would be an ANPD matter.

In case the vetoes pass through the National Congress, it is possible that the creation of the NDPA and other gaps resulting from the vetoes will be defined later, through a Provisional Measure or another bill.

The GLPD will enter into force 18 months after its publication and will be applicable against companies with operations in Brazil, even if their headquarters or data base is located elsewhere, bringing relevant changes to the rules data gathering and sharing, legal basis for data treatment, among others.

Feel free to contact us should you have any doubts on the matter.