New provisional measure guarantees functional autonomy for the ANPD

Report published on the Legal Consultant website about the provisional measure that transformed the ANPD into a local authority with agency functions. The site discussed the issue with several experts, such as Dr. Matheus Puppe, partner in the TMT, Privacy & Data Protection area at Maneira Advogados.

CHANGES TO LGPD

New provisional measure guarantees functional autonomy for the ANPD

June 14, 2022, 8:51 pm

President Jair Bolsonaro signed, this Monday (13/6), a provisional measure that transforms the National Data Protection Authority (ANPD), currently linked to the federal government, into an autarchy with agency functions.

With this, the ANPD now has the same levels of autonomy as the Central Bank, the National Health Surveillance Agency (Anvisa) and the National Telecommunications Agency (Anatel), for example.

In other words, it becomes more independent from the Presidency of the Republic and will be able to act autonomously before the Judiciary.

Matheus Puppe, partner in the TMT, Privacy & Data Protection area at Maneira Advogados, explains that the ANPD will have its own budget allocation and an internal prosecutor's office. “With this change, we observe a new cycle, where judicial and administrative actions will gain ground, and companies that have not yet adapted will have their risks exponentialized”, he indicates.

The prediction that the ANPD would act autonomously was in the initial text of the General Personal Data Protection Law (LGPD), but was vetoed due to legal defects related to the origin of the project. Then, it was converted into an authority linked to the Civil House.

Lawyer Adriano Mendes, partner responsible for the Digital and Data Protection areas at Assis e Mendes Advogados, explains that the measure is part of the set of actions taken by the Brazilian government so that the country can join the Organization for Economic Cooperation and Development (OECD).

The measure increases the chances of Brazil being recognized as a country with an adequate level of protection for personal data by the European Union. This is because the General Data Protection Regulation (GDPR) — a European law analogous to the LGPD — only authorizes companies in Europe to transfer personal data to other countries if there is, at the destination, one or more independent control authorities responsible for data protection.

“This is a big step for the Brazilian authority to have more similarity with European authorities, which will bring benefits to international cooperation”, says Antonielle Freitas, data protection officer (DPO) at Viseu Advogados.

“It is an important step for Brazil to be considered an adequate country in terms of data protection by the European Commission. Argentina and Uruguay, for example, in line with best international practices, already have autonomous authorities for data protection and are already considered adequate by the European Commission”, says lawyer Laércio Sousa, specialist in digital law and data protection at Velloza Advogados Associados.

He highlights that, currently, companies that are in Brazil with headquarters abroad need a series of measures to ensure security in the international transit of personal data. According to him, the MP simplifies, speeds up and gives more credibility to this exchange of information.

For Nádia Cunha, coordinator of the Contracts and Compliance Data Protection area at Jorge Advogados Associados, the MP “brings more security to data holders” and more effective action, “with many advances, especially in relation to supervision and application of sanctions to those who are not in compliance with the LGPD”.

In the view of lawyer Willian de Souza Campos da Silva, from the Data Protection area of the firm Peluso, Stupp e Guaritá Advogados, “combined with greater autonomy and technical and decision-making independence, now with the status of an autarchy, the ANPD will bring greater reliability and robustness to the Brazilian regulatory system in matters of privacy and protection of personal data, in addition to raising Brazil's level on the international stage in this regard.”

“This transformation was necessary and a desire of data protection professionals in the country”, highlights Marcelo Crespo, specialist in Digital Law and coordinator of the ESPM Law course. He points out that the provisional measure takes effect immediately, but depends on ratification in Congress to be converted into law.

According to Mendes, “it is highly likely that there will be no vetoes or obstacles to the conversion of the ANPD into a regulatory agency”, as the topic is technical and the text does not present “tortoises” (amendments with no connection to the core of the proposal).

The MP also determines the creation of a new regulation, via decree, to regulate its operation. “Considering the possibility of grafts and proposed changes to the text of the MP while it is being processed in Congress, the final text and concepts of autonomy, as well as the regulation of the ANPD, will only actually exist after approval of the final text in Congress and analysis for sanction or veto by the president, which should occur in the next 120 days”, indicates the lawyer.

Even so, it is not yet known how this will be applied in practice. This is the sixth change to the LGPD since 2018, and, according to Mendes, “adjustments and regulations are still needed at many points so that we have a fully effective standard.”

Marcelo Cárgano, a lawyer in the Digital Law area at Abe Advogados, highlights that “the changes brought by the MP do not put an end to the issue of the ANPD’s independence, but they are a step in the right direction.”

He highlights that the authority had been doing “a good job in editing regulations and procedures, analyzing regulatory impact, preparing guidance guides and communicating with the general population”. But, without administrative, financial or hierarchical autonomy, it could not, for example, “fully independently regulate the application of the LGPD in the context of elections”.

Legal Consultant Magazine, June 14, 2022, 8:51 pm