In the latest chapter of the discussions about Brazil’s LGPD, on August 26, 2020, the Senate rejected the article in the Executive Order (‘Medida Provisória’ – MP) which provided for the extension of its implementation to May 3, 2021. Accordingly, the MP will lose effect in relation to that article, and the LGPD will go into force promptly, pending only the presidential sanction. The implementation of the LGPD articles covering the administrative penalties remains set for August 1, 2021, as per the amended Law enacted on June 10, 2020.
The different implementation dates for the substantive part of LGPD and for its administrative penalties may cause a great deal of uncertainty. Although Brazil’s DPA—which is yet to be formed—could not apply penalties until August 2021, there is the risk that other law enforcement authorities, or even customers in bilateral contractual discussions, might seek to enforce the obligations and standards of the Law. Indeed, in a press article published today, August 28, 2020, in the mainstream business portal Valor Econômico, a public prosecutor affirmed that Brazil’s DPA will “start off weak as its priorities, in the first years, will be structural” and that “the Public Prosecutors’ Office has expertise of more than 20 years investigating data leakages.”