INTA Bulletin
Español Português 日本語 中文网站

December 1, 2018 Vol. 73 No. 20 Back to Bulletin Main Page

BRAZIL: Data Protection Law Enacted

In the wake of the European Union’s General Data Protection Regulation (GDPR), the new Brazilian Data Protection Act (LGPD) was enacted into law on August 14, 2018. It establishes, for the first time, a comprehensive system for personal data protection. Effective February 15, 2020, the LGPD applies to any public or private local company collecting data in the Brazilian territory, as well as to foreign entities processing or collecting data in the country or to those offering products or services to the Brazilian market, even if the data is processed abroad.

The LGPD broadly defines the concepts of “personal data” as “information related to an identified or identifiable natural persons” and “data processing” as the collection, production, use, reception to, storage, elimination, or transfer of personal data.

The new law provides specific sanctions for violations or noncompliance—from administrative fines of up to R 50 million per violation (approximately US $12.5 million) to corrective sanctions, such as removal of the violated personal data from the company’s database.

Brands that buy, sell, or share consumer personal data will be required to clearly disclose such practices to consumers and obtain their consent for not only their own use of the personal data, but also for that of third parties. The implementation of further layers of control and disclosures might also be necessary to ensure marketing practices, such as direct mail marketing, fall within the scope of the original consent given to the third parties.

As a comprehensive personal data protection law, the LGPD is expected to result in a cultural change with respect to privacy issues in Brazil. More frequently than not, consumers do not know what is being collected from them, why, and for what purpose. While the challenges of implementing compliant processes and policies are real for most companies, the new laws may represent a valuable competitive opportunity. Brands that truly embrace the principles of the new data protection legislation and are able to effectively provide consumers with control over how their data will be used might get ahead of the competition and gain access to high-quality consumer data. More than ever, trust is the name of the game.

The improper use of data, on the other hand, is likely to not only create liability for brand owners, but also to impact brand reputation and, eventually, to limit the brand´s ability to compete for access to the best consumer data.

Although every effort has been made to verify the accuracy of items in the INTA Bulletin, readers are urged to check independently on matters of specific concern or interest. Law & Practice updates are published without comment from INTA except where it has taken an official position.

© 2018 International Trademark Association