What laws apply to the collection and use of individuals’ personal information?
Data privacy laws have become more prominent in recent years. As the amount of personal information available online has grown substantially, there has been an enhanced focus on the processing of personal data, as well as the enforcement of such laws.
Brazil has a patchwork of rules and laws relating to employee data privacy, including the:
- Federal Constitution: Sets the basic framework and gives individuals the right to privacy as well as the right to compensation for economic and non-financial damages.
- Resolution 3/2009: Outlines privacy principles from Brazil’s Internet Steering Committee.
- Internet Law (12,965/2014): Outlines the principles for privacy and personal data protection, including requiring express consent from data subjects. Decree 8771, which relates to the law, sets the guidelines that should be followed.
- General Data Privacy Law (LGPD) (13,709/2018): This law, effective August 2020, modified the Internet Law and is Brazil’s first official data privacy framework. The LGPD impacts personal data processing in Brazil and shares some similarities to the European Union’s General Data Protection Regulation.
The Brazilian Consumer Protection Code (8078/1990), the Law on Public and Private Archives, the Bank Secrecy Act (Complementary Law 105/2001) and the Civil Code (10,406/2002) also include references to privacy and data protection.
_____________________________________
The national data protection authority (ANPD) will be responsible for enforcing data protection regulations and laws in Brazil. As of October 2020, the Senate is confirming the Directors of the national authority council.
Brazil has a patchwork of rules and laws relating to employee data privacy, including the:
