Data protection becomes a fundamental right in Brazil

The Brazilian Congress has enacted an Amendment to the Constitution that makes personal data protection a fundamental citizen right. The changes make personal data protection an unchangeable clause, meaning any changes to this theme will have to be aimed at expanding and protecting citizen rights.

Under the amendment to article 5 of the country’s Constitution, which relates to individual and collective rights, a new section has been added, noting “the right to protection of personal data, including in digital media, is ensured under the terms of the law.”

The president of the Brazilian Senate, Rodrigo Pacheco, said that the enactment of the amendment focused on personal data protection is a demonstration of Congress’ commitment “to the non-negotiable value of individual liberty.” Pacheco also noted the measure reinforces legal certainty and improves the environment for investments in the technology and communication sector in Brazil.

The proposal underpinning the amendment establishes that the federal government is solely responsible for the organization and supervision of the protection and processing of personal data and has exclusivity in terms of legislation relating to the protection and processing of personal information.

According to supporters of the proposals, this avoids the decentralized treatment of the theme by state and city legislation. Brazilian politicians in favor of the amendment  say the centralization of legislative competence around data protection matters is important as it also brings the General Data Protection Law (LGPD) to the Constitution. 

Introduced in September 2020, LGPD regulates personal data processing by individuals, public or private entities in Brazil across any medium, including digital media, with a goal of ensuring the privacy of data subjects.

The sanctions relating to the data protection regulations were enforced in August 2021, and fines can reach up to 2% of the company’s revenue in cases of non-compliance. The board members of the body responsible for enforcing the regulations, the National Data Protection Authority (ANPD), were appointed in October 2020, and the body announced its strategy in February 2021.

However, there are critics to the current data protection set up in Brazil. Consumer protection body Idec noted the provision for the creation of an independent data protection regulator was removed from the proposals when they were voted by the Lower House of the Congress. 

According to Idec, the fact that ANPD is linked to the president’s office is “something that goes against international recommendations for the constitution of authorities on the subject and jeopardizes the necessary supervision of data processing in the country.”

“Although the final proposal does not address the issue of [ANPD’s] independence, the new amendment to the Federal Constitution strengthens the fundamental right to the protection of personal data, previously recognized by the Federal Supreme Court, providing Brazil with yet another powerful legal instrument to protect rights of consumers and citizens”, the consumer body noted.