Practical Law: Data Protection Guide

Legislation

1. What national laws regulate the collection and use of personal data?

General laws
Brazil still lacks a general law concerning the protection of personal data. As part of a bigger effort towards regulating civil rights on the internet (which included the enactment of the Brazilian Civil Rights Framework for the Internet), the Ministry of Justice started working on a draft bill of Law on Data Protection in 2011.

The draft has undergone several periods of public consultations, whose contributions were gradually incorporated. The final draft was achieved and published in October 2015, and subsequently sent to the President's Chief of Cabinet, for consideration. A few more adjustments were made before the submission to the National Congress on 13 May 2016.

The draft was renamed Bill 5276/2016 and is currently being processed by the House of Deputies, where it is expected to be analysed by three commissions:

 

Commission of Constitution, Justice and Citizenship;
Commission of Science, Technology, Communications and Informatics;
Commission of Labour and Public Administration.

Public consultations and open debate are expected to take place following the bill's approval by the three commissions. While the procedural protocol for this bill has been tagged urgent, it is not possible, at this moment, to predict when the bill will be voted.

While the protection of personal data has yet to be fully recognised under the law, the Federal Constitution sets two fundamental rights that imply an important degree of protection for privacy. Under Article 5, Sections X and XII of the Federal Constitution determines the inviolability of privacy and private life, as well as guaranteeing the secrecy of correspondence and of telegraphic, data and telephone communications.

Sectoral laws
While lacking a general law on data protection, there are substantial levels of protection in several fields, under sectoral laws.

The most noticeable sectoral law is the Brazilian Civil Rights Framework for the Internet (Internet Act). The Internet Act contains a section regulating aspects of the protection of personal data processed online by connection providers and by internet application providers.

Further glimpses of protection of personal data can be found in the:

Consumer Protection Code, concerning the protection of personal data included in consumer-related databases (mostly regarding credit information);
Compliant Debtors List Act, concerning the collection, use and sharing of data registered in the credit databases of payers in good standing;
Tax Code, concerning tax secrecy;
Bank Secrecy Act, concerning the secrecy of banking operations;
Access to Information Act, concerning personal data registered in public databases.