As it is known and was informed yesterday, the Brazilian President sanctioned Law 13.709/18, which addresses the data protection in Brazil.
By and large, the new law defines very broadly personal data – following the provisions of the European regulation, the General Data Protection Regulation ("GDPR"). The law establishes how the information must be treated, requires that a purpose for the collection be stated, identifies and classifies the agents involved in this process, sets the informative principles, establishes the rights and obligations of those involved, classifies the sensitive data, regulates the data transfer, and indicates the responsibilities.
Notwithstanding the unquestionable legal certainty that the law brings, to the extent that it clearly and objectively set the rules on the matter, in practice its implementation will require a cautious management.
The ruling provides for a vacatio legis of one year and a half in order for the companies to have sufficient time to scrutinize the matter, solve practical issues, and safely adapt to the new model.
It should be observed that, in the wake of the subject, last June the State of São Paulo enacted Law 16758/18 (Law Leci Brandão), already in effect, that requires the collection of sensitive data related to color and racial identification.
This law provides that the collection of such information is compulsory for all records, databases, and similar registers of information, both public and private.
Once collected, these data must be sent every six months, through electronic means, to the coordination office of policies for the black and native Brazilian populations of the Department of Justice; the failure to comply with such obligation will cause the imposition of a fine established in the law as corresponding to 50 UFESPs (fiscal unit of the State of São Paulo).
The compliance with this law must be in line with the obligations set out in Law 13.709/18.
Aware of the importance of these matters and their impact on all business segments and their different areas, Demarest built a multidisciplinary team.
We are at your disposal to clarify doubts, provide consultancy, prepare lectures/workshops, all to assist you with finding the best alternatives to discuss and implement the necessary measures for the compliance with the new law.
Demarest Advogados | Digital Law and Data Protection