São Paulo – Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados – LGPD), whose enactment is expected to take place this month, is prompting a race to adapt to the new rules on the part of businesses. However, companies operating internationally must also factor in the law in the countries they are active in.
Attorney Thiago Martinelli Veiga (pictured above) is a partner at Martinelli, Freitas & Liberal Advogados Associados, in Florianópolis, Santa Catarina. An Arab Brazilian Chamber of Commerce (ABCC) member, the law firm is mostly active in corporate and digital law and the LGPD.
“Whenever data moves from one country to another, businesses must pay attention to legislation in the country that’s the source of the data as well as the target countries. Every company that’s involved in foreign trade or does business internationally will ultimately have to deal with this additional concern,” Martinelli told ANBA.
Some Arab countries have laws in place concerning data, the attorney said. According to France’s Commission Nationale Informatique & Libertés, Morocco and Tunisia have laws and national authorities on data protection, and laws to that end are in effect in Yemen, Algeria, Mauritania and Qatar.
Europe’s data protection laws are more comprehensive than Brazil’s, and the likes of Argentina, Uruguay and some states in the United States have similar laws in place. “Foreign law often requires higher safety levels from Brazilian companies than if they were only doing business locally,” Martinelli argued.
Corporate LGDP adaptation services available from the law firm includes optional modules covering data protection in other countries. Martinelli advises businesses to avoid deals involving large amounts of data transmission in countries with no legislation. According to him, data protection is increasing around the world, and a company can rise above the pack by being prepared when time comes to do business abroad.
Managing risk
When it comes to helping businesses adapt to the LGPD, Martinelli, Freitas & Liberal Advogados Associados will work out a client’s information flows, the type of data that it deals with and the risks they entail. Then, it works to enhance safety levels and manage data-related risk. That includes adapting contracts with third parties and providing training to staff.
According to Martinelli, the core purpose of the LGPD is to improve information safety within businesses and enable the sharing of data with the market. The law is designed to ensure the owners of the data are safe, he said. “The safer the data sharing system is, the more I can allow data to flow.”
He notes that the first step for companies that are new to this is to figure out how to protect client information. “The first thing is to be transparent about the relationship regarding data protection. To let people know what the data is and how it’s being treated,” he says, recommending that attention be paid to security levels in technological environments and elsewhere.
He remarks that Brazilian enterprises are at different stages when it comes to data protection. The financial sector is more attuned to it due to other regulations it needs to comply with. Other sectors, such as accounting and association-oriented ones, have no dedicated regulation or authorities to that end. In other words, some are prepared and some need to start from scratch.
Martinelli sees the law as a good thing. “The goal is to create a healthy environment for data sharing, and to prevent a flurry of data treatment lawsuits from people as a result of under-regulation. With the law, companies know what they must and what they can do. This gives them legal safety.”
Entry into force
Brazil’s data protection law is divided into three sections. The first one, concerning the creation of a National Data Protection Authority (Agência Nacional de Proteção de Dados), has been in effect since 2018. Section two concerns administrative sanctions to be enforced by the Authority. That is slated to become effective in August 2021. The third section, on data ownership rights and corporate obligations, is pending signature from president Jair Bolsonaro, which is expected to take place this month.
Martinelli notes that adaptation is in order even if sanctions are not enacted yet. Consumers can file civil lawsuits demanding compensation, and the Prosecutor’s Office might resort to the law to question corporate data protection behavior. “This must be an urgent concern,” he said.
In addition to Martinelli himself, Martinelli, Freitas & Liberal Advogados Associados includes partners Simoni Ribeiro de Freitas, Leandro Monteiro Liberal, and Paulo Potiara A. Veloso. It is going on three years in its current configuration, although its professionals have been practicing law for longer. The law firm’s partners hold masters’ and PhD’s, and they are also academically active at this time.
Quick facts
Martinelli, Freitas & Liberal Advogados Associados
Tel.: +55 (48) 3364 5347
Website
Translated by Gabriel Pomerancblum