Insights: Alerts LGPD In Effect: First Civil Action Filed in Brazil

Written by Nathalie S. Machado
LGPD Now In Effect

After a tumultuous legislative history, as noted in our previous alerts, the Brazilian Senate finally passed into law a revised proposal to remove any delays of the LGPD’s effectiveness. On September 18, 2020,1 the Brazilian president promulgated Law 14.058/2020 and Brazil’s comprehensive data protection law, the General Personal Data Protection Law (“Lei Geral de Proteção de Dados” or “LGPD”), entered into force immediately. 

While the data protection regulator (“Autoridade Nacional de Proteção de Dados” or “ANPD”) was implemented by a presidential Decree on August 27, 2020,enforcement-related provisions are only set to become effective on August 1, 2021, as provided by Law 14.010/2020.3

However, such delay does not eliminate LGPD enforcement, as the Brazilian Constitution grants a private right of action to all citizens and a public right of action to its “Ministério Público” or “MP” (Brazil Public Prosecutors’ Office). Specifically, the Ministério Público, which is composed by several offices at both the Federal and State levels, has several functions, including the role of instituting “civil investigations and public civil actions to protect the public and social patrimony, the environment and other diffuse and collective interests.”4 Further, the Brazilian Consumer Protection Code (the “CDC”) also provides that the “defense of consumers’ rights and interests may be exercised collectively.”5

First LGPD Lawsuit Filed

On September 21, 2020, merely three days after the LGPD’s entry into force, the Ministério Público do Distrito Federal e dos Territórios (“MPDFT”), based in Brasília, filed its first public civil action based on the LGPD.6 Specifically, the lawsuit was filed against a digital services company based in the state of Minas Gerais. According to the complaint, the targeted company holds data of 500,000 individuals of the city of São Paulo (including their name, email address, phone number and home address), which the company sells to other entities for marketing purposes. The complaint also states that potential buyers of data are able to purchase segmented personal data, such as data from medical doctors, accountants, hairdressers, engineers, etc., from specific states of Brazil.

It is important to highlight that the MPDFT has a dedicated unit specialized in data privacy and artificial intelligence (“Unidade Especial de Proteção de Dados e Inteligência Artificial” or “ESPEC”). The ESPEC is the first Brazilian initiative dedicated exclusively to the protection of the personal data and privacy of Brazilian citizens.

Conclusion

While administrative penalties are not going to occur before August 2021, it is imperative that companies with Brazilian operations take the necessary steps to adequately protect data and ensure LGPD compliance. Indeed, the MPDFT’s action is likely to serve as an encouragement for other MPs in Brazil to take the initiative in protecting data privacy rights.

Footnotes

Law 14.058/2020, dated September 17, 2020 (and promulgated on September 18, 2020), available at https://www.in.gov.br/en/web/dou/-/lei-n-14.058-de-17-de-setembro-de-2020-278155040
2  Presidential Decree 10.474/2020, dated August 26, 2020 (and promulgated on August 27, 2020), available at https://www.in.gov.br/en/web/dou/-/decreto-n-10.474-de-26-de-agosto-de-2020-274389226
3  Law 14.010 of June 10, 2020 (postponing the effectiveness of specific provisions to August 1, 2021), available at http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709.htm
4  Art. 129, III, Brazilian Federal Constitution of 1988, available at http://www.planalto.gov.br/ccivil_03/constituicao/constituicaocompilado.htm
5  Art. 81, Código de Defesa do Consumidor, Law 8.078/1990, dated September 11, 1990, available at http://www.planalto.gov.br/ccivil_03/leis/l8078compilado.htm
6  Ação Civil Pública, available at https://www.mpdft.mp.br/portal/pdf/Ação_Civil_Público_-_Infortexto_-_MPDFT_-_XXXXXX.pdf.

close
Loading...
If you would like to receive related insights and information from Kilpatrick Townsend, please provide your contact details by filling out the form and clicking “Agree.” If you would like to access the PDF only, please click “Download Only.”