GDPR Spurring Legal Reforms in South America With New Legislation In Brazil

As organizations continue to grapple with the requirements of the EU General Data Protection Regulation (GDPR) even months after its effective date, one thing is clear: The impact of the regulation extends far beyond an organization's European operations. The global effects of the GDPR are even more apparent when one surveys new and proposed data protection legislation around the world. On Aug. 14, 2018, Brazil signed into law the Lei Geral de Proteção de Dados Pessoais (LGPD), the first omnibus privacy law in the nation's history. The law, which is set to take effect on Feb. 16, 2020, is very similar to the GDPR, including in its expansive definition of personal data and its strong emphasis on both the rights of data subjects and the requirement of lawful bases of processing of personal data.

Personal Data

Under the LGPD, as under the GDPR, personal data means any information related to an identified or identifiable natural person. Also similar to the GDPR, the LGPD sets out heightened protections for certain sensitive categories of personal data, including data concerning an individual's racial or ethnic origin; public opinion; trade union membership; religious belief; membership in any religious, philosophical or political organization; health or sex life; genetic profile; and biometric measurements. Importantly, as under the GDPR, anonymized data, meaning data that has lost the possibility of direct or indirect association to a natural person using reasonable technical means, is not personal data under the LGPD.

Extraterritorial Application

As is the case with the GDPR, an organization need not have operations in Brazil to be subject to the LGPD. In addition to any processing of personal data taking place in the Brazilian territory, the law also applies in situations in which the purpose of processing is to offer goods or services to individuals in the Brazilian territory or when the personal data has been collected in the Brazilian territory.

Lawful Bases of Processing Personal Data

As to lawful bases of processing personal data, the LGPD takes a slightly different tack than does the GDPR, dictating 10 lawful bases for the processing of personal data, including the consent of the data subject or the legitimate interests of the controller or third parties. In addition, personal data may be processed for a controller's compliance with legal or regulatory obligations, certain activities by public agencies, research studies by authorized...