The battle over the entry into force date of Brazil’s Data Protection Act (LGPD) is coming to an end. After a long chain of events, Congress has until August 26, 2020, to make the final decision on whether the LGPD will be implemented on schedule on August 16, 2020, or delayed until May 3, 2021.
For the past few months, the National Congress of Brazil and the administration of President Jair Bolsonaro have clashed over whether to postpone the entry into force of the LGPD. Initially, the postponement of the LGPD was thought to be almost certain, with both Congress and the President pushing for a delayed implementation. Support for delaying the LGPD further intensified with the start of the COVID-19 pandemic, which made it more challenging for organizations to ensure compliance by August 16, 2020.
However, as the pandemic evolved, it also stirred up public opinion on the misuse of personal information in Brazil, causing Congress to shift its position and push for the LGPD to take effect on schedule. A turning point in the discussions can be traced to May 7, 2020, when the Brazilian Supreme Court issued a landmark decision that recognized data protection as a fundamental right in Brazil and suspended a Provisional Measure that would have allowed the public administration to carry out large-scale processing of personal information to fight the pandemic. Since then, further support has mounted for enacting the LGPD as originally planned and establishing a functional national data protection authority (DPA).
A lot has happened since the LGPD was signed into law. When the LGPD was published in the official gazette on August 15, 2018, it was due to take effect in February 2020. However, soon after publication, the President and Congress pushed back the entry into force until August 16, 2020.
When COVID-19 continued to spread in March 2020, the Brazilian Senate took action to try to delay the implementation of the LGPD until January 1, 2021, and further delay the possibility of imposing sanctions until August 1, 2021.
By late April 2020, and while the Senate’s proposal was still in Congress, President Bolsonaro moved to issue Provisional Measure (PM) 959/2020 to postpone the LGPD even further until May 3, 2021. And while he used his executive powers to effectuate this delay, it will only be final if it is also validated by Congress by August 26, 2020.
The issuing of PM 959/2020 caused Congress to fast track the Senate’s proposal to delay the LGPD. But, as time went by, support for the delay faded in Congress. Ultimately, Congress approved the Senate’s proposal to delaying LGPD sanctions until August 1, 2021. But that did not affect Congress’ separate validation of President Bolsonaro’s Provisional Measure delaying the entry into force of the remainder of the LGPD.
While the possibility of sanctions for violations of the LGPD has been delayed until August 2021, the final word on the entry into force of the rest of the LGPD is now still with Congress. If Congress does validate PM 959/2020, then the bulk of the LGPD will indeed be delayed until May 2021. However, it is also possible that Congress will reject the PM, propose amendments or even do nothing and simply let the PM expire, in which case the remainder of the LGPD could enter into force on schedule on August 16, 2020.
Whatever Congress does, it has until August 26, 2020 to do it. One way or another, the LGPD saga will soon be coming to a close.