National Congress debates the overturning of presidential vetoes made to Law n. 13.53/201

On August 24th, the National Congress overturned items previously vetoed from the project for conversion into law of the Provisory Measure 869/2018, which was converted into Law 13.853/2019, creating the National Authority for the Protection of Personal Data – NAPD and altering provisions of Law 13.709/2018, the General Law for the Protection of Personal Data – GLPD.

The overturned vetoes concern the operation of the NAPD, especially regarding the application of fines and penalties. With the overturning, the most severe penalties return to the list of application by the NAPD – it will have the power to apply penalties of partial suspension of the database related to the infraction, as well as suspend the data processing activities related to the infraction and partially or entirely prohibit the exercise of activities related to the processing of data. These penalties shall also apply to public entities, provided that Law no. 8.112/2018, Law no. 8.429/1992 and Law no. 12.527/2011 are observed.

It is also important to highlight that the penalties mentioned above shall only be applied by the NAPD after the application of at least one of the penalties established in items II, III, IV, V and VI of the caption of article 52 of the GLPD. In that sense, the more severe penalties shall be conditioned to the application, by the NAPD, of at least one penalty consisting of a simple fine, daily fines, publicizing of the infraction after the confirmation of its incidence, blocking of the personal data until the regularization of the infraction or the elimination of personal data related to the infraction.

In the event that the controllers submit to other entities and agencies with the competence to issue sanctions and penalties, the NAPD shall only apply the penalties of suspension of the database, suspension of the processing and prohibition of the processing of data after hearing such entities and agencies.

Moreover, in continuation of the deliberation on the vetoes, on October 2nd, the National Congress maintained the presidential veto to article 20 of the GLPD, which established the right to a revision by a natural person of decisions made based solely on automated processing. Thus, the maintenance of the veto makes it possible for data processing controllers to carry out the revision of automated decisions also by automated means.

SAEKI ADVOGADOS remains available to provide guidance in the necessary measures for complying with the dispositions of the GDPL and to clarify any questions that may arise.