Brazil’s New Data Privacy Law

New Legislation Enacted

On August 14, 2018, Brazil enacted its first omnibus data protection law, to become effective in February 2020. The new law amends the Brazilian Civil Rights Framework for the internet and is similar to the EU’s General Data Protection Regulation (GDPR). Under this law, American companies with operations in Brazil must implement standard contractual clauses or binding corporate rules, or obtain individual consent to transfer personal data from Brazil to their U.S. HQs, as the U.S. is not deemed as offering an “adequate” level of protection, and there is no Privacy Shield Framework between the two countries. Fines for noncompliance may be up to approximately $11 million.

Brazilian Supreme Court Ends Outsourcing Limitations

Precedential Decision by Judiciary or Regulatory Agency

Brazil’s Supreme Court recently ruled that companies may outsource any of their activities, including core business activities. The long-lived dispute stemmed from the labor courts declaring, without any legislative support, that it was illegal to outsource core business and from the continuous expansion of what constituted core business. Although last year’s labor law reform allows companies to outsource any activities prospectively, it did not resolve the dispute. With the Supreme Court’s ruling, more than 4,000 pending cases where the labor courts ruled that outsourcing was illegal will now be reversed.

eSocial - Deadlines for Second Group of Employers

Upcoming Deadline for Legal Compliance

All employers in Brazil must be fully registered with eSocial and report on employment, payroll, and health/safety data to the authorities under an implementation schedule. Employers with annual revenue of more than $18 million (first group) started using eSocial in January 2018. Employers with revenues of less than $18 million (second group) must register and submit their payroll information by November 2018. Those with annual revenue between $1 million and $18 million must complete Phase 1 by October 9 (by submitting their operating framework) and start Phase 2 by October 10 (to submit information on workforce, independent contractors, and employment/service agreements).