storage by entities of Public Administration. The Federal Law n
12.527/2011
doesn’t exclude public entities from following the Brazilian Personal Data Protection Law: both laws are applicable.
2.5 The Supervision Authorities
In 1995, the Brazilian Internet Steering Committee was created with the purpose of
coordinating and integrating all internet service initiatives in Brazil. It is composed
by representatives from civil society, corporate sector and Federal Government. The
mission of the Brazilian Internet Steering Committee involves: proposing policies
and procedures regarding the regulation of internet activates and the promotion of
studies and technical standards for network and service security in the country. Both
of these activities can be generally related to the supervision/controlling of personal
data shared on the internet.
3
In addition, it is important to note that the Brazilian Personal Data Protection Law
suffered some vetoes by the Brazilian President. The most significant of them was
the veto to (a) the creation of the Personal Data Protection National Authority, a
regulatory agency that would have the attribution to assure personal data protection,
and (b) the creation of the National Personal Data and Privacy Protection Council, an
entity that would be in charge of suggesting data protection policies. Such vetoes
were based on alleged unconstitutionality on formal grounds, since the Brazilian
Constitution provides that regulatory agencies may only be created by laws proposed
by the Federal Government. The law in question was, on the contrary, formally
proposed by the National Congress.
In order to solve this legal issue, the president enacted Provisional Measure n
869/2018, creating both supervisory bodies. The new measure provides attributions
almost identical to those of the original Bill of Law. The Personal Data Protection
National Authority is responsible not only for monitoring infractions and for applying sanctions, but also for establishing interpretations about data protection legislation, promoting cooperation with national and international authorities, among
others (Article 55-J). On the other hand, the National Personal Data and Privacy
Protection Council has the power to, for example, provide subsidies for the development of the national policy for personal data and privacy protection, conduct
studies and debates about these subjects and prepare annual reports evaluating the
implementation of the actions for following the national policy (Article 58-B).
The experience of other countries shows that the autonomy and independence of
the supervisory body is essential to personal data protection, because public authorities are often some of the major violators of citizens’ privacy. However, the new
Brazilian supervisory bodies did not have their full autonomy guaranteed by the
3 For more information: http://www.cgi.br/about/.
48
A. Schreiber
12.527/2011
doesn’t exclude public entities from following the Brazilian Personal Data Protection Law: both laws are applicable.
2.5 The Supervision Authorities
In 1995, the Brazilian Internet Steering Committee was created with the purpose of
coordinating and integrating all internet service initiatives in Brazil. It is composed
by representatives from civil society, corporate sector and Federal Government. The
mission of the Brazilian Internet Steering Committee involves: proposing policies
and procedures regarding the regulation of internet activates and the promotion of
studies and technical standards for network and service security in the country. Both
of these activities can be generally related to the supervision/controlling of personal
data shared on the internet.
3
In addition, it is important to note that the Brazilian Personal Data Protection Law
suffered some vetoes by the Brazilian President. The most significant of them was
the veto to (a) the creation of the Personal Data Protection National Authority, a
regulatory agency that would have the attribution to assure personal data protection,
and (b) the creation of the National Personal Data and Privacy Protection Council, an
entity that would be in charge of suggesting data protection policies. Such vetoes
were based on alleged unconstitutionality on formal grounds, since the Brazilian
Constitution provides that regulatory agencies may only be created by laws proposed
by the Federal Government. The law in question was, on the contrary, formally
proposed by the National Congress.
In order to solve this legal issue, the president enacted Provisional Measure n
869/2018, creating both supervisory bodies. The new measure provides attributions
almost identical to those of the original Bill of Law. The Personal Data Protection
National Authority is responsible not only for monitoring infractions and for applying sanctions, but also for establishing interpretations about data protection legislation, promoting cooperation with national and international authorities, among
others (Article 55-J). On the other hand, the National Personal Data and Privacy
Protection Council has the power to, for example, provide subsidies for the development of the national policy for personal data and privacy protection, conduct
studies and debates about these subjects and prepare annual reports evaluating the
implementation of the actions for following the national policy (Article 58-B).
The experience of other countries shows that the autonomy and independence of
the supervisory body is essential to personal data protection, because public authorities are often some of the major violators of citizens’ privacy. However, the new
Brazilian supervisory bodies did not have their full autonomy guaranteed by the
3 For more information: http://www.cgi.br/about/.
48
A. Schreiber