Brazil: Congress approves bill regulating the collection and processing of personal data

On 10 July, the National Congress approved Bill 53/2018, which regulates the protection of personal data in Brazil. The bill represents the finalisation of almost eight years of debates, which culminated on 17 July, when it was forwarded to the Brazilian Presidency, for approval. The deadline for approving or vetoing the bill was extended from the initial 15 working days until 14 August, due to some inconsistencies in the wording of the text.

There is concern among groups that participated in the drafting of the bill that the president will veto articles related to the creation of a National Data Protection Authority (ANPD). The authority is mentioned on more than 50 different occasions and according to the text approved by Congress, should be responsible for, inter alia, monitoring the implementation of the norms, specifying security standards and applying sanctions in case of abusive conducts.

Several entities have expressed support for the presidential approval of the entire text, without vetoes, especially for the creation of the ANPD, which is instrumental to fully implement the new data protection framework. On 24 July, the National Secretariat of Consumer Relations (Senacon), an entity under the remit of the Ministry of Justice, expressed full support for the bill, stressing the importance of the legislation for consumer protection and for Brazilian economic and social development, in a context where the collection and processing of personal data is a growing target for new investments and the emergence of new markets.