28 Jan 2021

Brazil’s new data protection law (No. 13.709) known as the General Personal Data Protection Law (or ‘LGPD’) followed in the footsteps of the European Union’s General Data Protection Regulation (GDPR) and finally came into force on 18 September 2020.

By Eduardo Boccuzzi, Boccuzzi Advogados Associados

LGPD deals with the processing of personal data and aims to protect the freedom and privacy of people, including employees, who have their data collected, stored and used in some way. The LGPD provides employees with a number of fundamental rights in relation to their personal data, and places obligations on employers to only handle personal data where they have a lawful basis for doing so. The LGPD echoes the GDPR in many instances, but also contains some specific nuances which employers should be aware of.

In the context of labor relations, there is constant processing of employee data, in all phases of the contractual employment relationship:

  1. Pre-Contractual: including the collection of identification data and CV data. Employers must inform unsuccessful candidates of its policy for using any data which was collected and what will be done with it, as well as request the candidate’s consent if it wishes to keep the data in its database.
  2. Contractual: data collection for registration, including bank data and health data. It is during the contractual phase that the employees will become aware of the company’s data processing policy and must give their express consent as to its content.
  3. Post-Contractual: storage of information of former employees for labor, social security and inspection purposes.

Improper use of employees’ personal data may give rise to administrative sanctions and an indemnity payment in labor lawsuits, especially if there is an exposure of intimate and sensitive data that could damage the employee’s personal rights.

Administrative sanctions range from a simple warning to the imposition of daily fines or even fines up to 2% of the company’s revenue.

Comment

It is essential to train the employees responsible for the processing of employees’ personal data, especially in the HR sector, as well as the review and amendment of internal rules and labor documents, in order to ensure that companies comply with the new law. Employers operating in Brazil should take note of these new changes, as well as companies with employees in Brazil, regardless of where the organization itself may be located.

© 2021 Boccuzzi Advogados Associados

Click here to see the full list of updates.