By Leonardo Neri

There has been much debate about the configuration of the new Personal Data Law, without due approval from the National Data Protection Authority (ANPD).

Some experts question the enforcement of the General Data Protection Law (LGPD), given that the sanctions provided for in the regulation are prerogatives of the ANPD.

It is important to remember that when sanctioning Law 13,709 on August 14, 2018, the president vetoed the creation of the ANPD, due to the ongoing discussion about whether or not it is possible to create a public body by law not specifically for this purpose. Now, the creation of the Authority may be done by Provisional Measure or even a new specific law.

However, there is also a group of people who argue that if the president were to enact the law with the inclusion of the ANPD, it would result in a long legal battle over the unconstitutionality of the normative provision, which would lead to a long period of controversy that would prevent the law from being sanctioned in 2018.

Thus, the law was enacted with the veto of the ANPD and will come into force 18 months after sanction, which will occur in February 2020.

Regarding the legal effects after the implementation of the law, it is first necessary to highlight the nature of the sanctions that are provided for in the LGPD and that are linked to the ANPD, that is, penalties of a purely administrative nature, the purpose of which is to encourage the re-education of the data user agent, focusing on compliance with the law. There is no compensatory bias related to non-compliance with the law, but rather of a retributive nature, as in traffic fines, for example.

However, the sanctions provided for in the ANPD in no way prevent the recognition of civil liability as a legitimate right of individuals who feel harmed by a certain act. This aspect is expressly stated in article 22 of the norm, which states that individuals may have their rights exercised in court, individually or collectively. In other words, anyone who feels offended may claim damages both in the sphere of the Common Justice and in the Special Courts. In the collective form, the Public Prosecutor's Office holds the same prerogative as an instrument of protection of a majority.

Without prejudice, the LGPD also provided that a natural person may present their reasons and seek balance in consumer relations, directly with consumer protection agencies, such as Procon.

Another timely issue to reflect on regarding the new law is that despite its entry into force without the ANPD, there is no obligation under the terms of the rule regarding the Authority's dependence for its compliance, as well as for generating its respective legal effects.

Therefore, there is a part of the LGPD that is in fact harmed by the non-creation of the ANPD, such as the application of administrative sanctions or the exercise of the rights provided for in article 18, referring to the provision to the user of data processed by the controller, which, in order to be exercised, depend on regulation.

Finally, companies and public bodies have less than 18 months to adapt to the rules of the new law, with or without the creation of the ANPD, since failure to comply with it may result in the controller being held liable in the civil sphere.