What does this cover?

A new version of the 'Draft Bill on Data Protection' (the Draft Bill) has been produced by the Ministry of Justice. Following on from the previous draft released in January 2015, the current Draft Bill is the product of numerous consultations from public and private sector bodies and addresses in more detail some of the key aspects of the Draft Bill, namely:

  • International Transfer of Data (similar level of protection or in specific situations);  
  • Definition of Personal Data;  
  • Data Anonymisation (newly added);  
  • Requirements for Treatment of Personal Data (including the definition of consent being widened; and the introduction of "legitimate interest" basis for processing non-sensitive personal data);  
  • Establishment of a National Counsel of the Protection of Personal Data.  

Before the legislative process can commence, the Draft Bill will need to be approved by the President's Chief of Staff. It will then be introduced to the Brazilian Congress, however, there are currently two additional privacy bills passing through the legislative process and in order for the new Draft Bill on data protection to proceed, it will need to either replace or be combined with these two privacy bills.

What action could be taken to manage risks that may arise from this development?

Financial services companies should monitor the progress of the Draft Bill as it passes through the legislative process.

Submitted by Nick O'Connell of Al Tamimi & Company – Dubai, UAE in partnership with DAC Beachcroft.