Today, December 28^th, 2018, Provisional Measure No. 869/2018, which amends the General Law on the Protection of Personal Data (Law No. 13,709 – “GLPD”), was published in the Official Federal Gazette. The Provisional Measure was expected since the sanction of the GLPD in August of this year, and modifies several articles of current legislation.

One of the main alterations is the creation of the National Data Protection Authority (“NDPA”), which had been vetoed by the Presidency of the Republic when the GLPD was sanctioned. The body will not be an autonomous entity, but linked to the Presidency of the Republic, with technical autonomy only.

The NDPA shall be composed of (i.) the Board of Directors (the highest governing body), (ii.) the National Council for the Protection of Personal Data and Privacy, (iii.) the Internal Affairs Bureau, (iv.) Ombudsman Bureau, (v.) its own advisory body and (vi.) administrative units necessary to apply the provisions of the GLDP. The Provisional Measure also provides that the Board of Directors shall be composed of five directors, who shall be appointed by the President of the Republic and shall have a term of office of four years.

The Provisional Measure establishes that the NDPA will have competence for (i.) the issuance of norms and procedures on the protection of personal data, (ii.) the deliberation, in the administrative sphere, on the protection of personal data, (iii.) the request of information to the controllers and operators of personal data (iv.) the supervision and application of sanctions in case of data processing performed in violation of the GLDP, as well as (v.) the implementation of mechanisms, including by electronic means, for registration of complaints about the processing of personal data in violation of the legislation.

The Provisional Measure also sets forth the exclusivity of the NDPA in the application of the sanctions provided for in the current legislation, independently of the attributions of the other bodies of the Federal Administration. Additionally determines that the NDPA will articulate its work with the National Consumer Defense System of the Ministry of Justice and other bodies with sanctioning jurisdiction related to the subject of personal data protection, being the central body for the interpretation of the GLDP and the issuance of norms and guidelines for its implementation.

The Provisional Measure, however, is not restricted to the creation of the NDPA. Among the other alterations, the change in the definition of Data Protection Officer is worthy of highlight. In line with European legislation, the Provisional Measure excluded the definition that the Data Protection Officer is an “individual indicated by the controller” and the final language determines only that those functions shall be performed by a “person indicated by the controller”. The tendency, therefore, is that the Data Protection Officer is not required to be necessarily an employee of the company that processes data.

Another relevant modification is the revocation of the requirement to provide information to the data subject, in cases that the processing occurs for the purpose of compliance with a legal or regulatory obligation.

Finally, the Provisional Measure also postponed the date GLDP shall enter into force, which would initially occur in February 2020. Although the articles referring to the creation of the NDPA are effective immediately, the remaining provisions of the GLDP will enter into force 24 months after date of publication (and not 18 months anymore), i.e., on August 15^th, 2020.

To access the full text of the Provisional Measure, click here.

Souto Correa is available for any clarification on the subject.