* By Carolina Gladyer Rabelo Saches and Cintia M. Ramos Falcão
With a plot full of comings and goings, confusions and exciting twists, as well as discussions worthy of being televised, part of this story reached its final chapter: the LGPD came into force last Friday, 9/18.
But this is not the end, our dear!
Many emotions are yet to come and the controversies continue, whether due to the search for adequacy or clarification of some points that were somewhat "nebulous".
THE Law No. 13,709 / 2018, known as General Law on Protection of Personal Data or, for the most intimate, as LGPD, it originally established the beginning of its validity in 24 months after its publication, that is, initially it would be valid from August 15, 2020.
However, much has changed with the pandemic caused by the new coronavirus.
The edition of Decree nº 6/2020 - which recognized the occurrence of the state of public calamity in the country - boosted the search for all sectors of the economy for the extension of the rules that would have a great impact on the daily lives of companies and people.
In this sense, MP 959/2020 was issued, a legal act that included an article that established the extension of the term to 2021. This article was unanimously rejected by Congress, under justification of prejudice - which means, in a simplified way, that a bill (or a text with a very similar content) had been deliberated before.
Hence, on 9/17, the presidential sanction, published on 9/18, took place and, thus, the LGPD provisions became effective immediately.
OK! Pacified that the LGPD is effective from 9/18, what about the 24-month date provided in the law itself?
That is where the character “confusion of duration” comes in, one of the controversies that this episode presents us.
A discussion was created about what will happen with the relations covered by the LGPD during the period from 15/8 (24 months from the date of publication of the law) to 9/18 (day when the law came into force)
According to scholars, the consolidation of legal relations during this period will only occur with the publication of a decree - which leaves us in a legal limbo, until this occurs.
At this moment, the second controversy comes on the scene: where is the ANPD (National Data Protection Authority) - the competent body for ensuring the implementation and enforcement of the law?
The creation of the ANPD was foreseen in the original text of the LGPD, however it was vetoed by the ex-president Michel Temer under the allegation of “origin addiction”. Currently, although a decree has already been issued approving its structure, it is awaiting the appointment of the CEO and publication of its operating rules, so that, then, they become effective.
It happens that the LGPD presents numerous points that depend on regulations and specification of details addressed to the ANPD, such as the duty to report by the data subject (article 18, § 1) or by the controller (article 48).
The question then remains: in the absence of the ANPD what to do?
We are sorry, but there is no pacified understanding ... However, it is recommended that companies and public bodies fulfill the duty to report, regardless of the existence of the ANPD. Companies must make such communication directly to the sector's own regulatory body, such as the Central Bank, among others, minimizing any gaps and potential non-compliance with the law.
But this mystery does not end there ... The ANPD also has the function of standardizing understandings about LGPD, the absence of this body being a real source of different understandings about the applicability of the law. After all, our country has continental dimensions, and, depending on the region, there may be many interpretations regarding the norm.
There is also a debate about their autonomy. Following the standard used in international laws on the subject, such as the GDPR, the regulatory body should be an autonomous and independent authority. Despite this understanding, the ANPD has hierarchical subordination, acting as an integral part of the Presidency of the Republic. Considering that the LGPD will also be applied to public bodies, the possibility of a conflict of interest in these cases should be considered.
Without overcoming this mystery, we will go to the points of attention of the law, because, like the LGPD, we seek to guarantee the data subject their right to privacy, intimacy and the free development of the natural person's personality.
To assist in this objective, nothing better than a compilation of the best moments. After all, it is recognized and ratified that the adaptation to the LGPD is necessary, and understanding its content and implications is of paramount importance for the citizen, for companies and public bodies.
If in any way you process personal data, the LGPD is applied to you. The first point is to understand the concept of personal data (concept provided for in Article 5 as information related to the identified or identifiable natural person) and to what kinds of personal data you have access.
Another point of attention is related to the collection and use of data, and it is necessary to obtain an authorization from the data holders before this collection - this is the “consent” mentioned in the standard. After the data has been collected, the holders have the right to: access its content, perform its portability, request correction or update, request its exclusion and, furthermore, to be informed how these are being used.
It is important to clarify that there is no magic formula to adapt to the LGPD, the first step is to understand it and study the implications for your business.
The most recommended way to carry out the adaptation process is to involve the organization as a whole, create multidisciplinary work groups, map the flow of input, treatment and output of personal data, improve public data (such as privacy policy), carry out the indication of the DPO on the website and train your employees.
Finally, the third controversy, the most awaited scene of this last episode, the penalties for those who breach the provisions of the law.
As provided in the LGPD (article 52), the violation of the law culminates in the application of administrative sanctions according to the gravity of the infraction - the sanctions varying from: warning, fine, publication, blocking and / or elimination of personal data, suspension and / or prohibition of the database functioning. Fines for non-compliance can reach 2% of turnover, limited to R$ 50 million per infraction.
Just to remember the problem, during the chapter of its approval, the Chamber of Deputies maintained the postponement of the application of penalties for non-compliance with the law until next year, exactly on January 1, 2021. Thus, there is, in practice, a vacatio legis for the application of the penalty, concentrated between articles 52—54 of the LGPD.
But do not think that this postponement means that breaking the law will have no consequences! Remember that the regulatory bodies and the Judiciary are there ... and the LGPD is already in force, being subject to the application of different penalties to those who are not adequate to its regulations.
Well ... we think that, at the end of this episode, the publication of the LGPD instead of being an "end" is in reality a "continuum", being merely the end of a single season. Let us hope, then, that the new season will be “launched” so that together we can unravel all its mysteries…
* Carolina Gladyer Rabelo Saches is the legal director of ABBC - Associação Brasileira de Bancos, a PhD in Economic Law from PUC-SP and an executive program at the Massachusetts Institute of Technology (MIT).
* Cintia M. Ramos Falcão is a lawyer working in the area of Banking and Regulatory Law and Legal Consultation at Acrefi - National Association of Credit, Financing and Investment Institutions; postgraduate in Consumer Relations at PUC-SP and specialist in Digital Law and MBA in Finance at Insper.
Legal Consultant Magazine, September 25, 2020, 7:30 pm
