Data Protected - Brazil

Contributed by Mattos Filho

Last updated March 2020

General | Data Protection Laws

National Legislation
National Supervisory Authority
Scope of Application
Personal Data
Sensitive Personal Data
Data Protection Officers
Accountability and Privacy Impact Assessments
Rights of Data Subjects
Security
Transfer of Personal Data to Third Countries
Enforcement

ePrivacy | Marketing and cookies

National Legislation
Cookies
Marketing by E-mail
Marketing by Telephone

_____________________________________________________________________

General | Data Protection Laws

____________________________________________________________

National Legislation

General data protection laws 

The Brazilian General Data Protection Law No. 13,709/18 (Lei Geral de Proteção de Dados or “LGPD”).

Please note that the LGPD will not come into force until late 2020 and therefore this summary reflects the future position under that law only.

Entry into force

The LGPD will enter into force in August 2020.

_____________________________________________________________________ Top

National Supervisory Authority

Details of the competent national supervisory authority

The National Data Protection Authority (Autoridade Nacional de Proteção de Dados or “ANPD”).

The ANPD is in the process of establishing premises and setting up a website.

Notification or registration scheme and timing

There is no general obligation to make a prior notification to the ANPD about details of regular processing activities. However, there are obligations to notify specific events, such as data breaches, which are addressed below.

Exemptions to notification

Not applicable.

_____________________________________________________________________ Top

Scope of Application

What is the territorial scope of application?

The LGPD has an extraterritorial reach. It applies to any processing activity, regardless of where the organisation collecting the data is established, if: (i) the processing is carried out in Brazil; (ii) the data has been collected in Brazil; and (iii) the processing is related to individuals in Brazilian territory or to the supply of goods or services in Brazil.

Is there a concept of a controller and a processor?

Yes. The LGPD establishes a concept for both. The controller is the person who can make decisions related to the processing of personal data. This person may be an individual or entity, whether public or private.

The processor is the individual or entity, whether public or private, that conducts the processing of personal data on behalf of the controller.

Are both manual and electronic records subject to data protection legislation?

Yes. The LGPD is applicable regardless of the means that the data is processed.

Are there any national derogations?

The LGPD is not applicable to data processing: (i) carried out by a natural person for exclusively private and non-economic purposes; (ii) carried out exclusively for journalistic, artistic or academic ends so long as, whenever possible, the personal data is anonymised; (iii) carried out for the exclusive purposes of public security, national defence, state security or investigation and prosecution of criminal offences; or (iv) relating to personal data that originated in other countries and only passed through Brazil in transit.

_____________________________________________________________________ Top

Personal Data

What is personal data?

Personal data is information related to an identified or identifiable individual. Thus, it includes any information that identifies or can identify a person, such as names, numbers, identification codes, or addresses.

Is information about legal entities personal data?

No. The LGPD only applies to personal data about individuals. It does not regulate data about companies or any other legal entities. However, information about one-person companies may constitute personal data where it allows the identification of a natural person.

What are the rules for processing personal data?

The LGPD establishes ten principles for the processing of personal data. These are that personal data must be: (i) processed for legitimate, specific and explicit purposes of which the data subject is informed (purpose); (ii) processed in a manner compatible with the purposes communicated to the data subject (suitability); (iii) the minimum necessary to achieve those purposes (necessity); (iv) available for consultation by data subjects free of charge (free access); (v) accurate, clear, relevant and kept up to date (data quality); (vi) accompanied by clear, precise and easily accessible information about the processing (transparency); (vii) subject to technical and organisational security measures (security); (viii) subject to measures to prevent damage (prevention); (ix) not processed for unlawful or abusive discriminatory purposes (non-discrimination); and (x) processed in a manner that allows demonstration of measures to prove compliance (accountability).

In addition, the processing can only take place where one of the follow legal bases apply to the processing: (i) the data subject consents; (ii) it is for compliance with a legal or regulatory obligation; (iii) it is by the public administration; (iv) it research, ensuring anonymisation where possible; (v) it is necessary for the performance of a contract; (vi) it is for judicial or arbitral purposes; (vii) it is for the protection of life or physical safety; (viii) it is for the protection of health and carried out by a health professional; (ix) it is necessary to fulfil the legitimate interests of the controller or third party, and is not overridden by the data subjects’ rights; and (x) it is for the protection of credit.

Are there any formalities to obtain consent to process personal data?

The LGPD establishes that consent is a free, informed and unequivocal manifestation of the data subject that authorises the processing of personal data for a certain purpose. Generic authorisations, that is, authorisations that do not have a specific, explicit and informed purpose, are not effective.

Consent must be in writing or another means that demonstrates the manifestation of the will of the data subject.

Data subjects must be told of their right not to provide consent and the consequences of such refusal. Data subjects can also withdraw consent, which must be possible through a free and easy procedure.

Are there any special rules when processing personal data about children?

The processing of personal data of minors (which is any person under the age of eighteen) must be conducted in their best interest.

The processing of personal data of minors requires specific and conspicuous consent by at least one of the parents or legal guardian. Controllers must use every reasonable effort to verify that the consent was provided by the person responsible for the minor. The LGPD, however, allows the collection of personal data without the consent of parents or legal guardians in order to contact the parent or legal guardian. In this case, the personal data collected without consent may only be used once and it may not be stored under any circumstance, considering that its only purpose is to contact the parents or legal guardian.

Are there any special rules when processing personal data about employees?

There are no additional rules when processing personal data about employees.

_____________________________________________________________________ Top

Sensitive Personal Data

What is sensitive personal data?

Sensitive personal data is any personal data related to the racial or ethnic origin of an individual, religious belief, public opinion, membership in a union or religion, philosophical, or political organisation, data related to the health, sex life, genetics or biometrics, when linked to an individual.

Are there additional rules for processing sensitive personal data?

The restrictions in the LGPD are strict for processing sensitive personal data.

It can only be processed where: (i) the data subject specifically and distinctly consents for a specific purpose; (ii) it is for compliance with a legal or regulatory obligation; (iii) it is by the public administration; (iv) it is for research, ensuring anonymisation where possible; (v) it is for judicial or arbitral purposes; (vi) it is for the protection of life or physical safety; (vii) it is for the protection of health and carried out by a health professional; and (viii) it is for fraud prevention.

The LGPD does not allow processing sensitive personal data to fulfil the legitimate interest of the controller or third parties or for credit protection.

Are there additional rules for processing information about criminal offences?

No. The LGPD is also not applicable to data processing carried out for the exclusive purposes of investigating and prosecuting criminal offences.

Are there any formalities to obtain consent to process sensitive personal data?

Consent for processing sensitive personal data must be given specifically and distinctly and must be for a specific purpose.

_____________________________________________________________________ Top

Data Protection Officers

When must a data protection officer be appointed?

A data protection officer must be appointed by the controller in all cases that involve the processing of personal data, including processing activities carried out by public entities.

What are the duties of a data protection officer?

The activities of a data protection officer include: (i) accepting complaints and notifications from data subjects, providing clarifications and adopting necessary measures; (ii) receiving notifications from the ANPD; (iii) informing employees and contracted parties within the organisation about the practices to be taken in relation to the protection of personal data; and (iv) executing other activities determined by the controller or established in supplementary regulations issued by the ANPD.

_____________________________________________________________________ Top

Accountability and Privacy Impact Assessments

Is there a general accountability obligation?

Yes. The LGPD has as one of its principles a general accountability obligation. This requires the demonstration and adoption of effective measures capable of proving compliance with data protection law and demonstrating the effectiveness of these measures. Moreover, the adoption of these measures is a mitigating factor if sanctions are imposed.

Are privacy impact assessments mandatory?

Privacy impact assessments must be provided to the ANPD, upon request. Therefore, even though they are not initially mandatory, it is highly recommended to have them already developed.

_____________________________________________________________________ Top

Rights of Data Subjects

Privacy notices

Data subjects have the right to have easy access to information relating to the processing of their personal data. This includes, but is not limited to: (i) the specific purpose of processing; (ii) the form and duration of the processing; (iii) the identification and contact details of the controller; (iv) details of any shared use of data; (v) the responsibility of processing agents; (vi) the processing of personal data as a condition for providing the product or service, or for exercising a right, if applicable; and (vii) the rights of the data subject.

Such information should be provided in a clear, appropriate and prominent manner.

Rights to access information

Data subjects have the right to access their personal data.

Rights to data portability

The LGPD created the right to portability, through which the data subjects may request the transfer of their personal data to another service or product supplier.

Right to be forgotten

The LGPD itself does not refer to the right to be forgotten. However, based on the Brazilian Federal Constitution principle of human dignity, the Brazilian Federal Supreme Court has recognised the applicability of the right to be forgotten in the civil sphere when invoked by a data subject.

Objection to direct marketing

The LGPD makes no reference to the right of objection to direct marketing and profiling. Notwithstanding, such right may be considered an extension of the data subject’s right to withdraw consent or object to processing based on the legitimate Interests condition.

Other rights

The data subject has the right to: (i) correction of incomplete, inaccurate, or outdated data; (ii) anonymisation, blocking, or elimination of data that is unnecessary, excessive, or processed in noncompliance with the provisions in the LGPD; and (iii) deletion of personal data that is processed with the data subject’s consent on withdrawal of that consent, except if the data is processed to fulfil any legal or regulatory obligation.

_____________________________________________________________________ Top

Security

Security requirements in order to protect personal data

Controllers and processors must protect personal data against unauthorised access and accidental or illicit situations such as destruction, loss, change, communication or any form of improper or illicit handling of personal data.

Technical and administrative security measures must be adopted for this purpose. The ANPD is responsible for determining the minimum technical standards for the protection of personal data, especially for sensitive personal data. Regulators, such as health and financial sectors, may also establish such minimum security requirements.

Specific rules governing processing by third party agents (processors)

There is no express requirement for a controller to enter into a contract with a processor. However, documenting this relationship by contract is strongly recommended.

Notice of breach laws

Security incidents that may entail significant risk or damage to data subjects must be communicated to the ANPD and the data subjects within a reasonable period.

_____________________________________________________________________ Top

Transfer of Personal Data to Third Countries

Restrictions on transfers to third countries

The cross-border transfer of personal data is permitted where it is to a country with an adequate level of protection, which will be evaluated by the ANPD. This will involve an assessment of, among other things, the adoption of security measures, the nature of data and the general standards in effect in the country of destination or in the international body.

Cross-border transfers are also permitted where the controller guarantees the protection of personal data through: (i) contractual clauses specific to the transfer; (ii) standard contractual clauses; (iii) global corporate rules; or (iv) certificates or codes of conduct.

In addition, cross-border transfer is permitted when: (i) it is necessary for international legal cooperation between government intelligence, investigations, and prosecution authorities; (ii) it is authorised by the ANPD; (iii) it is necessary for public policies or public service activities; (iv) data subjects have provided specific and conspicuous consent for the transfer upon prior information; (v) it is necessary for the fulfilment of a legal or regulatory obligation on the part of the controller; (vi) it is for a contract or procedures related to a contract in which the data subject is a party, as required by the data subject himself; and (vii) it is for the regular exercise of rights, including contractual performance and in court, administrative, or arbitration proceedings.

Notification and approval of national regulator (including notification of use of Model Contracts)

As set out above, one situation in which transfers are permitted is where authorised by the ANPD. Similarly, the use of specific clauses, global corporate rules or certificates and codes of conduct require authorisation from the ANPD.

Use of binding corporate rules

The LGPD contains the concept of global corporate rules, which are analogous to binding corporate rules. These must be approved by the ANPD.

_____________________________________________________________________ Top

Enforcement

Fines

Controllers and processors that breach the LGPD can be subject to the following administrative sanctions: (i) a fine of up to two percent (2%) of a private legal entity’s, group’s or conglomerate’s revenues in Brazil, for the prior financial year, excluding taxes, up to a total maximum of BRL $50 million (approximately EUR 9 million) per infraction; and (ii) daily fines.

Imprisonment

The LGPD does not allow imprisonment for breach of the LGPD.

Compensation

Controllers or processors that breach the law and cause material or moral damage are liable to compensate data subjects.

Other powers

The ANPD may issue a warning, with an indication of the time period for adopting corrective measures. It may also: (i) publicise a breach; (ii) block the processing of personal data to which the breach relates until the breach is remedied; and (iii) order the deletion of the personal data to which the breach relates.

The ANPD can audit processing carried out in violation of the LGPD and request information at any time from controllers and processors.

Practice

The ANPD has been formally established but is not yet operational, so there is no existing practice.

_____________________________________________________________________ Top

ePrivacy | Marketing and cookies

_____________________________________________________________

National Legislation

ePrivacy laws

The Self-Regulation Code for Email Marketing Practice 2009 (Email Code) regulates electronic marketing.

There are a number of other ePrivacy laws such as the Law No. 12,737/2012, which amends the legal provisions on the Brazilian Criminal Code (Federal Decree-Law No. 2,848) regarding privacy invasion on digital devices and the interruption of telecommunication services. The Brazilian Internet Act (Law No. 12,965/2014) regulates the use of connection and access logs, as well as the contents of private communications. The Wiretrap Act (Law No. 9,296/96) provides that the access to and interception of communications may only occur under the authority of a valid court order in criminal investigations proceedings. The Telecommunications Act provides that clients’ information can only be used for delivering services, and that telecom bills can only be revealed upon the express consent of the user or by valid court order.

_____________________________________________________________________ Top

Cookies

Conditions for use of cookies

The LGPD does not specifically regulate the use of cookies.

However, if the data subjects do not agree to the usage of cookies, it should be possible to disable this function. This is based on the need to show a lawful basis, such as consent or legitimate interests.

Regulatory guidance on the use of cookies

Not applicable.

_____________________________________________________________________ Top

Marketing by E-mail

Conditions for direct marketing by e-mail to individual subscribers

The LGPD does not cover regulatory conditions for direct marketing by e-mail to individual or corporate subscribers. However, under the general provisions of the LGPD, particularly the need for a lawful basis for processing, the direct marketing must provide an opt-out tool for individual subscribers.

In addition, the Self-Regulation Code for Email Marketing Practice 2009 recommends getting consent before sending direct marketing emails. Where there is an existing relationship, marketing may be possible to send marketing emails on an opt-out basis.

Conditions for direct marketing by e-mail to corporate subscribers

Not applicable.

Exemptions and other issues

Not applicable.

_____________________________________________________________________ Top

Marketing by Telephone

Conditions for direct marketing by telephone to individual subscribers (excludes automated calls)

The LGPD does not regulate direct marketing by telephone to individual and corporate subscribers. However, some Brazilian states have introduced “do not call” lists.

Conditions for direct marketing by telephone to corporate subscribers (excludes automated calls)

The LGPD does not regulate direct marketing by telephone to individual and corporate subscribers. However, some Brazilian states have introduced “do not call” lists.

Exemptions and other issues

Not applicable.

_____________________________________________________________________ Top