General Law for the Protection of Personal Data in the possession of Obliged Subjects

The Decree issuing the General Law for the Protection of Personal Data in the possession of Obliged Subjects (“LGPDPSO”) has been published today and will enter into force on January 27, 2017.

The regulatory authority empowered to exercise the provisions of the LGPDPSO is the National Institute for Transparency, Access to Information and Protection of Personal Data (“INAI”), which at the same time regulates and enforces the Federal Transparency and Personal Data laws that precede the LGPDPSO.

The LGPDPSO is part of the set of statutes that supports the National System of Transparency, Access to Public Information and Protection of Personal Data (“National Transparency System”), together with the General Law on Transparency and Access to Public Information and the Federal Law on Transparency and Access to Public Information, which must comply with the provisions of the LGPDPSO, within six months of its entry into force.

In addition, the National Transparency System is an essential part of the National Anticorruption System, which was published on July 18, 2016.

The purpose of the LGPDPSO is to establish the principles and procedures for guaranteeing the right of everyone to the protection of their personal data when they are in the possession of any authority, entity, body or agency of the executive, legislative and judicial branches, either at the federal, state and municipal levels, as well as autonomous bodies, political parties, trusts and public funds (identified as “Obliged Subjects”).

The LGPDPSO introduces provisions on data portability and regulates the relationship between the Obliged Subjects, as data controllers, and those who intervene as data processors. In the same way it regulates transfers and remissions of personal data; establishes preventive actions during the process; means for contesting unlawful processing of personal data and sanctions, as well as a verification procedure that can be initiated ex officio by the INAI.

It contemplates an obligation for the authorities of the National Transparency System, to issue a “National Program for the Protection of Personal Data” within a term of one year after the entry into force of the LGPDPSO.

It establishes the duty for the Obliged Subjects, to process, issue or modify their internal regulations at the latest within eighteen months following the entry into force of the LGPDPSO.

The entry into force of the LGPDPSO, derogates all provisions regarding the protection of personal data of a federal, state and municipal level that contravene the provisions of the LGPDPSO.

Personal data in possession of individuals or legal entities (including trade unions) any other natural or legal person who receives and exercises public resources will continue to be processed in accordance with the Federal Law on the Protection of Personal Data held by Private Parties.