LGPD Unveiled: A Closer Look at Brazil’s Data Protection Regulations

Unraveling the complexities of data protection may be tedious, especially if you are not familiar with them. Discover more in this insightful post as our compliance specialist, Tiana Dermendjieva, delves into the intricacies of data protection in Brazil.

The LGPD (Lei Geral de Proteção de Dados), or the Brazilian General Data Protection Law, was officially made law on August 14, 2018. This came after several years of in-depth talks and consultations. A lot of the ideas in the LGPD come from the GDPR (General Data Protection Regulation).

This study delves into the similarities and differences between two laws, exploring aspects like their scope, data controllers’ roles, treatment of children’s data, legal grounds for data usage, record-keeping rules, cross-border data transfer, the role of Data Protection Officers, response to data breaches, individuals’ rights, and supervisory authorities’ powers.

Personal scope

Similarities

Differences

Territorial scope

Similarities

Differences

Material Scope

Similarities

Differences

Controllers and Processors

The GDPR and LGPD have similar definitions and responsibilities for data controllers and processors, as well as similar liability clauses, although there are nuanced differences in terms of joint and several liabilities and exemptions.

GDPR mandates a contractual or legal agreement binding processors to controllers, outlining processing terms, while it does not specifically address liability in Consumer-Based Services.

In contrast, the LGPD does not necessitate a contract, requiring processors to follow controller instructions. Additionally, in LGPD, joint liability arises in consumer-based services due to the application of the Consumer Protection Code.

Children’s Data

Both the GDPR and the LGPD emphasize clear and accessible information for children.
Unlike GDPR, which allows Member States to set a minimum age not below 13, LGPD consistently establishes the minimum age at 13. Both regulations necessitate using available technologies to reasonably verify consent and ensure that information is presented in a manner understandable to children.

Legal Basis

The GDPR and the LGPD share several commonalities in their legal bases for processing personal data.

Similarities

Differences

Data Transfers

Regarding the data transfers, the GDPR and LGPD do share some similarities. The GDPR evaluates adequacy as assessed by the European Commission, allowing transfers to such countries. Safeguards in both regulations involve mechanisms such as binding corporate rules, standard data protection clauses, approved codes of conduct, and certification mechanisms. Additional legal grounds for data transfer encompass judicial cooperation, explicit consent, contract performance, public interest, legal claims, and vital interests. Moreover, both regulations permit transfers based on legally binding instruments between public authorities and administrative arrangements.

In the LGPD, the transfer to countries with adequate protection is similarly allowed, with safeguards including specific contractual clauses, standard contractual clauses, global corporate rules, and recognized quality seals, certificates, and codes of conduct. The LGPD also recognizes other legal grounds, such as international legal cooperation, protection of life or physical safety, specific and outstanding consent, contract execution, and legal proceedings. Additional transfer grounds in LGPD include specific contractual clauses, supervisory authority authorization, international cooperation agreements, and compliance with legal or regulatory obligations. These frameworks highlight the importance of establishing secure and lawful mechanisms for the international transfer of personal data.

The GDPR introduces distinctive provisions, allowing transfers of personal data from public registers and transfers based on the legitimate interests of the controller. The latter provision specifically applies to non-repetitive, limited-number subject transfers, provided suitable safeguards are in place to ensure data protection. In contrast, LGPD lacks similar unique provisions, indicating a divergence in the specific regulations governing data transfers between the GDPR and LGPD frameworks.

Data Processing Records

Both the GDPR and the LGPD share the commonality that controllers and processors are obligated to maintain records of their personal data processing activities.

However, differences arise in the specifics of these requirements.

Under the GDPR, small organizations with fewer than 250 employees may be exempt from record-keeping unless their processing activities pose risks to data subjects, are not occasional, or involve special data categories. Detailed obligations outline what controllers and processors must record, including name and contact details, processing purposes, data categories, recipients, international transfers, erasure time limits, and security measures.

Unlike the GDPR, the LGPD imposes a universal obligation for record-keeping on all organizations, regardless of their size or the type of data processed. Exemptions to this requirement are contingent upon approval from the supervisory authority. Noteworthy is the LGPD’s lack of explicit specifications regarding the detailed information controllers or processors are required to record, setting it apart from the more detailed and prescriptive record-keeping obligations outlined in the GDPR. These subtle distinctions underscore the divergent approaches adopted by the two regulations in addressing the responsibilities related to recording data processing activities.

DPIA (Data Protection Impact Assessment)

Some of the similarities for the DPIA between the GDPR and LGPD may include:

Similarities

Differences

DPO (Data Protection Officer)

The GDPR does provide for appointing one for a company. However, it does not include a definition of a DPO. Some of the tasks of DPO include:

◦ Advising the controller or processor on GDPR compliance
◦ Monitoring compliance and staff training
◦ Advising on DPIAs
◦ Acting as a point of contact for data subjects and authorities. Contact details must be published and communicated to the supervisory authority.

It also obligates both controllers and processors to appoint a DPO in specific circumstances related to scale and types of data processed.

The LGPD does also provide for appointing a DPO and it also includes a definition of a DPO as a person designated by the controller, acting as a communication channel between the controller, data subjects, and the supervisory authority. The tasks are:

◦ Accepting complaints and communications from data subjects
◦ Receiving communications from the supervisory authority and advising entity’s employees
◦ Orienting employees and contractors on data protection practices
◦ Carrying out other duties as determined by the controller or in complementary rules. Identity and contact information should be publicly disclosed.

Only controllers must appoint a DPO, and there are no specific limitations on when a DPO must be appointed; this is left to the ANPD.

The difference between the GDPR and LGPD is that the GDPR allows a group of undertakings to appoint a single DPO, provided they are easily accessible from each establishment. It also stresses the independence of the DPO and mandates the provision of monetary and human resources for fulfilling their tasks. In contrast, the LGPD does not explicitly mention whether a group of entities may appoint a single DPO and it does not explicitly establish the independence of the DPO or provide for monetary and human resources to be given to the DPO for fulfilling their tasks.

Data Security and Data Breaches

Similarities

Difference

Individuals’ rights

The GDPR and LGPD share several key rights concerning data subjects. Both regulations grant individuals the Right to Erasure, allowing them to withdraw consent under specified conditions. The Right to be Informed mandates detailed privacy notices, encompassing personal data categories, DPO contact, and third-country transfers. The Right to Object permits objections to data processing based on legitimate interests, with a specific provision for opting out of direct marketing. Both frameworks implicitly address the Right not to be Subject to Discrimination through principles like fair processing and transparency.

Notably, the GDPR’s Right of Access requires a response within one month, extendable by two more months, and provides a comprehensive list of information to include. In contrast, the LGPD stipulates a 15-day response time for the Right of Access, with less explicit guidance on the information to be included. Regarding the Right to Data Portability, the GDPR emphasizes a ‘structured, commonly used, machine-readable format,’ while the LGPD allows portability to another service or product provider and imposes limits on sensitive health data for economic advantage unless expressly consented by the data subject. These nuanced variations underscore the convergence and divergence between the GDPR and LGPD in safeguarding data subject rights.

Enforcement

The two regulations empower their respective supervisory authorities to impose monetary penalties for violations. In alignment, both frameworks consider factors such as severity, intent, and cooperation with the authority when determining the fines. Additionally, supervisory authorities, including the GDPR and the LGPD’s ANPD, are authorized to develop guidelines for calculating these penalties.

However, notable differences exist between the two regulations.

The GDPR enforces a single category of administrative fine, applicable to government bodies as well, with penalties reaching up to 2% or 4% of the global annual turnover or €10 million/€20 million, whichever is higher. Member States can establish rules for applying fines to public bodies. In contrast, the LGPD introduces two types of fines—simple and daily—with daily fines designed to enforce previous decisions.

The LGPD fines are limited to 2% of a private legal person’s revenues in Brazil, capped at BRL 50,000,000 per infraction, and notably, government agencies are exempt from administrative fines under the LGPD.

These distinctions highlight the varied approaches and nuances in the penalty structures of the GDPR and LGPD.

Supervisory Authority

Similarities:

Differences:

Conclusion

While the GDPR and the LGPD share significant similarities across various aspects of data protection, there are nuanced differences that should not be overlooked.

Achieving compliance with the GDPR does provide a strong foundation for LGPD compliance, but it is not a one-size-fits-all solution.

To fully comply with the LGPD, organizations may either adapt existing GDPR-based compliance documents to also meet LGPD requirements or develop a separate set of compliance documents specifically tailored to the LGPD.

This approach ensures that you are not only compliant but also well-prepared for the legal and regulatory landscapes of multiple jurisdictions.

For more information, please contact us at [email protected].