Brazil: Adopted ANDP Preliminary Analysis of Data Protection Standards regarding Law 2630/20

On 27 April 2023, the Data Protection Authority (ANDP) issued a preliminary analysis of the Internet Freedom, Accountability and Transparency Act (law 2630/20), currently under deliberation in the National Congress. The law would establish data protection standards, rules for data access for research purposes and consent-based data processing requirements. The ANDP points out that the law would attribute the data protection oversight to an "autonomous supervisory entity", which could be in direct conflict with the powers of the ANDP that are given through the General Data Protection Law (LGPD). The ANDP noted that the law could contribute to uncertainty and regulatory fragmentation. Additionally, the ANDP asserts that it will continue being Brazil's main enforcement entity of data protection standards. The ANDP recommended amendments to the law to preserve the ANDP's powers. Furthermore, the ANDP noted that law 2630/20 allows for more lax data retention obligations concerning criminal investigations, and the language describing the process is too vague. According to ANDP, it would allow for the broad collection of personal data and contribute to unjustified surveillance and tracking. The ANDP advises restricting and defining the language further to ensure the data may only be collected according to a specific purpose and allow for the adoption of relevant security measures.