Is LGPD In Effect, or What?

By Sally Luz-Wilson

Editor’s Note: On August 26, the Brazilian Senate passed a bill making the LGPD effective immediately, reversing a House decision from the day before. Brazil’s president has 15 days to sign it into law. See this article from the IAPP for more details.

The Brazilian Congress is expected to vote on MP nº 959/2020 (Provisional Measure nº 959/2020) this Tuesday, August 25. The MP nº 959/2020 is the provisional measure that changes the effective date for most of the articles of the Lei Geral de Proteção de Dados Pessoais (LGPD) to May 3, 2021. The original effective date for the LGPD was August 16, 2020, but due to COVID-19, President Jair Bolsonário decided to postpone applying the LGPD until next year by issuing this provisional measure.

As the news broke about the vote, originally intended for last week and then delayed, some confusion started to revolve around how it may affect the application of the bulk of the LGPD. At this time there’s no clear answer when LGPD will come into effect, but we can better understand the options for the path forward.

Provisional measures in Brazil

Provisional measures are legal acts found under the Federal Constitution of Brazil, that allow the president to enact a law that is effective immediately without the vote of Congress in the case of urgency and relevancy to the matter to be regulated.

The catch with provisional measures is that they need to be approved by both houses of Congress to become a definitive law. The law to delay the LGPD enacted by the president of Brazil and has the legal effect of an ordinary law, is currently in effect. But it will expire within 120 days (an initial 60-day time frame with an automatic renewal of another 60 days) of its enactment if the Congress does not vote to approve it.

Usually, the process when a provisional measure arrives in Congress is:

  • The MP is analyzed by a mixed commission with selected members from the Chamber of the Deputies and the Senate. This commission can agree with the MP as it is and send it to be voted on by both houses; or it can make a change to the MP, sending it to both houses as a converted bill.

  • The MP or converted bill first goes to the chamber of Deputies for a vote, and if approved to the Senate floor. If the MP or converted bill passes in both houses, it will be forwarded to the President.

  • The President can sanction it or veto it.

Where are we now?

MP nº 959/2020 was enacted on April 29, 2020 and so it will expire on August 26, 2020. The mixed commission has expressed that the effective date of the LGPD should remain the original date of August 2020, thereby transforming the MP into a converted bill. This bill is in the Chamber of Deputies awaiting a vote.

There are so many variants that it is hard to predict what the outcome will be. The fact is that the original effective date has passed (16th August 16, 2020), which means we’re left with three likely options:

  • If the MP fails to postpone the effective date to May 2021, the Congress would likely enact a legislative decree to a new effective date for enforcement of the LGPD.
  • If Congress allows the MP to expire, we would end up with the same result.
  • If Congress passes the MP and the prorogation is accepted, then LGPD will be live in May next year.

As of today, the LGPD is not in effect. When will it become effective? For now we have to wait and see what the Brazilian Congress will decide.

One thing is for sure, LGPD is coming, and the time to prepare is now. Sentinel’s consultants are up-to-date on LGPD and how it intersects with other data protection laws around the globe. Let us help you create an LGPD compliance plan that’s right for your organization.

Get started today

Ensuring digital security and compliance for your future.