Big changes at the ANPD with Provisional Measure No. 1124 | Insights and Events
On Monday, Interim Measure No. 1124 has been published, amending Law No. 13,709 of 2018 – the General Brazilian Law of Protection of Personal Data (LGPD) – which makes significant changes to the configuration of the National Data Protection Authority (ANPD).
Provisional Act No. 1.124 of 2022 does not modify the attributions of the ANPD nor its general organization chart provided for in art. 55 et seq. of the LGPD but essentially transforms the ANPD into an autarky of a particular nature. To this day, the ANPD is an integral part of the presidency, as provided for in its regimental structure. When the new regimental structure of the ANPD is published, the ANPD will have technical and decision-making autonomy, its own assets and a legal personality separate from the presidency.
Although it still needs to be approved by the National Congress to become law, the interim measure is already in effect.
This change has practical consequences, such as:
- Increased levels of independence and autonomy for the ANPD. Being seen as an autonomous entity is essential for inspection and sanctioning bodies, and this change removes the hierarchical subordination of the ANPD, giving the ANPD autonomy similar to that of other special regime agencies, such as other Brazilian regulatory agencies and the Brazilian Central Bank.
- Allow the ANPD to act autonomously before the judiciary. By becoming an autarky with a special character, the ANPD acquires procedural autonomy, very relevant for the personal data protection plan in the country, increasing the execution capacities of the ANPD. Therefore, it is possible for the ANPD to bring public civil actions.
- One more step on the road to recognition by the European Union of Brazil as a country with an adequate level of personal data protection. In the EU, there are certain requirements in this regard under the General Data Protection Regulation (GDPR). One of the elements analyzed to assess the level of compliance in terms of personal data protection is the independence and non-subordination of the authority responsible for the protection of personal data in the country. This recognition would be beneficial for Brazil.