Brazilian Senate overturns postponement of data protection regulations

In the latest chapter of the data protection regulations saga in Brazil, the Brazilian Senate has reinstated the original timescales for the introduction of the new rules later this year.

The change emerged as the Senate revised an amendment that relates to a series of measures around the Covid-19 pandemic and proposed pushing the introduction of the rules to May 2021. As a result of a remote voting session that took place yesterday (19) the law is expected to go live in August 2020 as planned, while sanctions for non-compliance will be enforced from August 2021 onwards.

President Jair Bolsonaro now needs to sign the revised amendment into law. However, the maintenance of the original plan for implementation of the data protection regulations introduces legal uncertainty for businesses when it comes to compliance to the new rules, since procedures are not yet standardized and members of the National Data Protection Authority, which would be responsible for the enforcement of the rules, are yet to be appointed.

The postponement of the sanction deadlines, therefore, means that any adjustments required around data protection regulations will be made after the rules are enforced. This creates a situation where businesses lack clarity as to what needs to be done, and, on the other hand, would not be held responsible for any potential infractions.

According to experts, introducing the data protection rules without a governing body introduces additional problems. The role of the agency would likely be played by the prosecutor's office at a state and federal level, as well as consumer rights bodies, which would weaken the original function of the data protection authority.

Meanwhile, the level of awareness and concerns over data privacy online is growing in Brazil, with more users looking to increase control over how their data is handled and the majority of Internet users trying to remove their personal data from social media platforms, according to a recent study by Kaspersky.

Separate research by The Harris Poll on behalf of IBM suggests that most Brazilians don't trust companies with their personal data, with 5 in 10 consumers claiming to know that their information is always, or often shared with other organizations they are unaware of. Some 81 percent of Brazilians admitted to having lost control in terms of how their data is being used by companies.