What laws apply to the collection and use of individuals’ personal information?
Data privacy laws have become more prominent in recent years. As the amount of personal information available online has grown substantially, there has been an enhanced focus on the processing of personal data, as well as the enforcement of such laws.
Brazil has a patchwork of rules and laws relating to employee data privacy, including the:
- Federal Constitution: Sets the basic framework and gives individuals the right to privacy as well as the right to compensation for economic and non-financial damages.
- Resolution 3/2009: Outlines privacy principles from Brazil’s Internet Steering Committee.
- Internet Law (12,965/2014): Outlines the principles for privacy and personal data protection, including requiring express consent from data subjects. Decree 8771, which relates to the law, sets the guidelines that should be followed.
- General Data Privacy Law (13,709/2018): This law, which goes into effect in August 2020 modifies the Internet Law and is Brazil’s first official data privacy framework. This law will impact how personal data is processed in Brazil and shares some similarities to the European Union’s General Data Protection Regulation.
The Brazilian Consumer Protection Code (8078/1990), the Law on Public and Private Archives, the Bank Secrecy Act (Complementary Law 105/2001) and the Civil Code (10,406/2002) also include references to privacy and data protection.
_____________________________________
The national data protection authority (ANPD) will be responsible for enforcing data protection regulations and laws in Brazil (note that the members of the ANPD have not yet been selected as of November 2019).
Brazil has a patchwork of rules and laws relating to employee data privacy, including the:
