Put Leonardo Neri and Barbara Oliveira  – 01/06/2020

The General Data Protection Law (LGPD) has not yet come into force, but it has already had a direct impact on contracts involving the collection, storage and processing of data.

The LGPD was published in August 2018 and may come into force in August 2020, or, if Provisional Measure No. 959 does not expire, the start of its validity would be delayed until May 2021. However, it is already possible to see the impact of the new law on everyday relationships.

Due to the severity of its punishments, as well as the increase in social and consumer demands, companies have chosen to adapt in advance to the provisions and determinations of the LGPD, given that, although not yet legally enforceable, there is an evident requirement imposed by the market itself, especially in reference to consumer relations.

TikTok Case

Consumer protection agencies have already been monitoring companies to ensure they comply with the LGPD, even if it is not yet in force. Last month, ByteDance Brasil (TikTok) received a notification from Procon-SP asking it to clarify an alleged violation of children's privacy, also questioning whether the company was in compliance with the LGPD.

The actions of consumer protection agencies have been criticized, given the requirement to adapt to the Law that is not yet in force, which would violate the principle of legality, provided for in article 5, item II, of the Federal Constitution, in addition to increasing the legal uncertainty that already surrounds the LGPD.

The lack of a National Data Protection Authority, which should have already been created, also contributes to consumer protection agencies exercising the role of monitoring companies' compliance with the LGPD, giving the legislation a consumerist bias.

Microsoft's hiring by TJ-SP

In another example, the LGPD also had an impact on the hiring of Microsoft by the Court of Justice of São Paulo (TJ-SP), for the development of the Lex Platform, for the digital processing of processes, in addition to technology infrastructure and cloud data storage, replacing the system eSAJ.

The contract that had been signed at the beginning of 2019, worth R$1.32 billion, without a bidding process, was already the subject of a trial at the National Council of Justice (CNJ), which had already determined the suspension of the contract, under the allegation that the storage of Brazilian judicial data by a company based abroad would put Brazil's security and national interests at risk.

In parallel with the CNJ decisions, data security experts also criticized the contract signed between the TJ-SP and Microsoft, stating that the contract would be in disagreement with several provisions of the LGPD, which would make the installation of the new platform unfeasible. This is because, according to US law, the storage of data in US territory allows any judge to request it, thus exposing the personal information of millions of Brazilians.

The two examples presented portray the practical effects that the LGPD has already been causing even before it comes into force, demonstrating the existence of a natural market demand that makes companies adapt to the legal provisions, in addition to putting at a disadvantage those that choose to wait for it to come into force to start complying with the legislation. What is noticeable is the existence of a tendency towards adaptation, whether in contracts between companies, which have started to require their partners to comply with the LGPD, or by demand from the data subjects themselves.