Brazil has a Data Protection Law

A further and relevant development in the data protection landscape in Brazil, the country’s first data protection bill has been signed into law by the President, and published in the official journal August 15. The law will be in full force in 18 months, by February 2020. The national framework now provides mechanisms to ensure consent, legal grounds for processing, purpose and time limitation, security, universally recognized data subjects’ rights, rules on breach reporting and on transnational data transfers. Some of the mechanisms in the bill were vetoed by the President, as it was the case of the suspension and prohibition of processing and storing activities, on the grounds that the text as it was might risk the stability of strategic services, such as financial ones. Another relevant veto concerned the creation of an independent and autonomous national data protection authority, and of a national data protection council. According to the President, the bill as it was presented could not have formally approved the creation of the structures. He promised to send an appropriate proposal to the parliament addressing those issues soon.