Brazil’s data protection law shows uneven progress in two years

We say in Brazil that some laws simply don’t stick. They exist but, for all intents and purposes, they are disregarded by citizens and therefore become ineffective. Two years ago, when Brazil’s General Data Protection Law (LGPD) came into force, it seemed it would be another of those cases. Brazilian companies have historically neglected cybersecurity and data protection, and users didn’t seem particularly bothered about the new law.

And yet, public officials are doing their darndest to make it stick.

Last week, the Supreme Court limited data sharing among government agencies to the “minimum necessary.” Additionally, the court said data must only be exchanged for “legitimate, specific, and explicit” purposes, as established by the LGPD.

The ruling was in response to a lawsuit filed against a 2019 decree by President Jair Bolsonaro, compelling all federal bodies to share most of the data they hold on Brazilians — including health records, employment information, and even biometric data. All of this would comprise a vast master database named the Basic Citizen Registry.

Solicitor General Bruno Bianco told the Supreme Court that data-sharing practices made life easier for Brazilians. He mentioned that 35 million people — mostly seniors with mobility issues — were no longer required to undergo proof of life tests to continue receiving pension payments thanks to that practice. 

But the Brazilian Bar Association says the decree is akin to “techno-authoritarianism” and would allow for the construction of an “extremely dangerous state surveillance tool.”

The Brazilian Socialist Party, one of the plaintiffs in...