The Brazilian president has sanctioned, on July 9th, the law that creates the Brazilian Data Protection Authority (“ANPD”). The future authority will be part of the President’s cabinet for the next 2 years, when it might become an independent agency afterwards, and be composed by 5 directors. Among its activities, ANPD shall be responsible for elaborating guidelines for the National Policy on Personal Data Protection and Privacy and enforcing the Brazilian Personal Data Protection Law (13.709/18) with the possibility of imposing fines for non-compliance.
The sanctioned law, however, was vetoed in some of its provisions. Among them: the possibility of ANPD to charge fees for services rendered; the prohibition before imposed to public authorities of not sharing personal data of those that have requested information under the Access of Public Information Law; and the reduction of previous sanctions list to only notices and fines of up to 2% of non-compliant company revenues.
All vetoed provisions were included by Congress in the process of reviewing the provisional measure enacted by the former president Michel Temer. Now as vetoes of any law, Congress must evaluate them and decide on if they will be maintained.
