Data:Brazil - Revision history

Paul Stein: /* Data Portability beyond the LGPD */

2026-10-09T12:23:35Z

Data Portability beyond the LGPD

← Older revision		Revision as of 14:23, 9 October 2026
Line 16:		Line 16:
	<div></div>		<div></div>
	<div>In Brazil, there are also efforts towards an obligation of data portability, but its conception comes from [https://legalblogs.wolterskluwer.com/competition-blog/brazil-seeks-to-amend-its-competition-law-a-regulatory-model-a-la-allemande/ a different lens from that of the EU and its Digital Markets Act (DMA)], with [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets somewhat different objectives and mechanisms]. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The Bill No. 4675/2025 aims to amend the Brazilian Competition Law] so that CADE (Conselho Administrativo de Defesa Econômica), the competition authority, [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets can impose special rules on the largest digital companies], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm including, if it so decides, an obligation to allow data portability].</div>		<div>In Brazil, there are also efforts towards an obligation of data portability, but its conception comes from [https://legalblogs.wolterskluwer.com/competition-blog/brazil-seeks-to-amend-its-competition-law-a-regulatory-model-a-la-allemande/ a different lens from that of the EU and its Digital Markets Act (DMA)], with [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets somewhat different objectives and mechanisms]. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The Bill No. 4675/2025 aims to amend the Brazilian Competition Law] so that CADE (Conselho Administrativo de Defesa Econômica), the competition authority, [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets can impose special rules on the largest digital companies], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm including, if it so decides, an obligation to allow data portability].</div>
	<div style="text-align: justify;" ><br></div>		<div style="text-align: justify;"><br></div>
	<div style="text-align: justify;" >For data portability, [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE, on its own initiative or at the request of any interested party, decides whether a company is “systemically relevant”], [https://eur-lex.europa.eu/eli/reg/2022/1925/oj similar to a DMA gatekeeper]. Then, the organization decides if [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm “free data transfer tools for end users” (Article 47-E, V(a))] applies to the specific company. If imposed by CADE, [https://www.dataprivacybr.org/nota-tecnica-sobre-o-texto-substitutivo-ao-pl-4-675-2025-dep-aliel-machado/ the company builds the tool and users request transfers directly from it, CADE only supervises]. [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en Unlike the DMA, where portability applies automatically to every gatekeeper], here it can vary. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The provision covers both personal and non-personal data], [https://ejlt.org/index.php/ejlt/article/view/988 as the DMA does]. However, it doesn’t say whether data generated by the user’s activity is included and it doesn’t mention transfers to third parties either, or no requirements of real-time access [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en while the DMA does]. It also [https://www.techpolicy.press/building-trust-for-data-portability-within-the-dma-framework/ lacks rules on vetting recipients], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm makes coordination with the data protection authority optional, and needs about a year of procedure before any duty applies]. [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Personal data in any transfer remains subject to the LGPD].</div>		<div style="text-align: justify;">For data portability, [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE, on its own initiative or at the request of any interested party, decides whether a company is “systemically relevant”], [https://eur-lex.europa.eu/eli/reg/2022/1925/oj similar to a DMA gatekeeper]. Then, the organization decides if [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm “free data transfer tools for end users” (Article 47-E, V(a))] applies to the specific company. If imposed by CADE, [https://www.dataprivacybr.org/nota-tecnica-sobre-o-texto-substitutivo-ao-pl-4-675-2025-dep-aliel-machado/ the company builds the tool and users request transfers directly from it, CADE only supervises]. [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en Unlike the DMA, where portability applies automatically to every gatekeeper], here it can vary. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The provision covers both personal and non-personal data], [https://ejlt.org/index.php/ejlt/article/view/988 as the DMA does]. However, it doesn’t say whether data generated by the user’s activity is included and it doesn’t mention transfers to third parties either, or no requirements of real-time access [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en while the DMA does]. It also [https://www.techpolicy.press/building-trust-for-data-portability-within-the-dma-framework/ lacks rules on vetting recipients], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm makes coordination with the data protection authority optional, and needs about a year of procedure before any duty applies]. [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Personal data in any transfer remains subject to the LGPD].</div>
	<div style="text-align: justify;" ><br></div>		<div style="text-align: justify;"><br></div>
	<div style="text-align: justify;" >[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm Only the private sector is affected; public bodies can merely ask CADE to act]. [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets Only very large holders are bound: groups with revenue above R$5 billion in Brazil or R$50 billion worldwide]. Small firms are never bound and are meant to benefit as recipients of users’ data. [https://eur-lex.europa.eu/eli/reg/2022/1925/oj Unlike the DMA, which designates each gatekeeper’s core platform services one by one], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm the bill measures size at the level of the whole group, and CADE may then limit obligations to specific services]. There are no fixed exceptions. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE “may consider” information security and the company’s other legal duties], and [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm for personal data the LGPD protects trade secrets and excludes anonymised data].</div>		<div style="text-align: justify;">[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm Only the private sector is affected; public bodies can merely ask CADE to act]. [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets Only very large holders are bound: groups with revenue above R$5 billion in Brazil or R$50 billion worldwide]. Small firms are never bound and are meant to benefit as recipients of users’ data. [https://eur-lex.europa.eu/eli/reg/2022/1925/oj Unlike the DMA, which designates each gatekeeper’s core platform services one by one], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm the bill measures size at the level of the whole group, and CADE may then limit obligations to specific services]. There are no fixed exceptions. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE “may consider” information security and the company’s other legal duties], and [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm for personal data the LGPD protects trade secrets and excludes anonymised data].</div>
	<div style="text-align: justify;" ><br></div>		<div style="text-align: justify;"><br></div>
	<div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The objective of the proposed bill would be to reduce entry barriers and promote user choice] by weakening the data advantage of dominant platforms, [https://ejlt.org/index.php/ejlt/article/view/988 the same competition logic as the DMA]. Nevertheless, the main blind spot is that the bill creates a power for CADE, not a right for users. As a result, users’ portability will depend on which platform they use and what CADE decided for it. [https://telesintese.com.br/pl-dos-mercados-digitais-pode-ficar-para-2027/ As of October 2026, the bill had not been voted on].</div>		<div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The objective of the proposed bill would be to reduce entry barriers and promote user choice] by weakening the data advantage of dominant platforms, [https://ejlt.org/index.php/ejlt/article/view/988 the same competition logic as the DMA]. Nevertheless, the main blind spot is that the bill creates a power for CADE, not a right for users. As a result, users’ portability will depend on which platform they use and what CADE decided for it. [https://telesintese.com.br/pl-dos-mercados-digitais-pode-ficar-para-2027/ As of October 2026, the bill had not been voted on].</div>
	<div><br></div>		<div><br></div>
Line 27:		Line 27:
	<div></div>		<div></div>
	<div>In terms of IoT data portability, in the case of Brazil, [https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d9854.htm no Brazilian law requires connected products to be designed so that users can pass that data to another provider easily], there’s not [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained EU Data Act] equivalent.</div>		<div>In terms of IoT data portability, in the case of Brazil, [https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d9854.htm no Brazilian law requires connected products to be designed so that users can pass that data to another provider easily], there’s not [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained EU Data Act] equivalent.</div>
	<div style="text-align: justify;" ><br></div>		<div style="text-align: justify;"><br></div>
	<div style="text-align: justify;" >Brazil relies instead on [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes], each of which obliges the companies it supervises to let customers move their data to a competitor, works only inside its own sector, and [https://normativos.bcb.gov.br/Lists/Normativos/Attachments/51028/Res_Conj_0001_v7_L.pdf almost always relies on the customer’s consent and standardised technical interfaces]. Examples are [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy, under which electricity distributors must let consumers share their smart-meter data with other suppliers], and [https://www.camara.leg.br/propostas-legislativas/2259727 the pending bill on agricultural data (PL 4123/2020)], [https://www.camara.leg.br/noticias/1213909-comissao-aprova-regras-para-proteger-dados-de-produtores-rurais/ which would do the same for farm machinery].</div>		<div style="text-align: justify;">Brazil relies instead on [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes], each of which obliges the companies it supervises to let customers move their data to a competitor, works only inside its own sector, and [https://normativos.bcb.gov.br/Lists/Normativos/Attachments/51028/Res_Conj_0001_v7_L.pdf almost always relies on the customer’s consent and standardised technical interfaces]. Examples are [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy, under which electricity distributors must let consumers share their smart-meter data with other suppliers], and [https://www.camara.leg.br/propostas-legislativas/2259727 the pending bill on agricultural data (PL 4123/2020)], [https://www.camara.leg.br/noticias/1213909-comissao-aprova-regras-para-proteger-dados-de-produtores-rurais/ which would do the same for farm machinery].</div>
	<div style="text-align: justify;" ><br></div>		<div style="text-align: justify;"><br></div>
	<div>[https://www.infoteca.cnptia.embrapa.br/infoteca/bitstream/doc/1172022/1/FL-Governanca-agrodados-2024.pdf Sources mostly agree there’s a problem with IoT data portability in Brazil], and [https://jota.info/opiniao-e-analise/artigos/data-act-da-uniao-europeia-um-modelo-de-regulacao-de-dados-12032024 some opinion pieces argue for a Data Act-style law], but no study shows that a Data Act copy is the fix. The Data Act’s efficacy is still unproven: [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained its rules have applied only since 2025], and there’s already academic pieces like [https://academic.oup.com/grurint/article/72/2/120/6754210 Kerber (2023) which argues that portability works mainly with detailed sectoral regulation].</div>		<div>[https://www.infoteca.cnptia.embrapa.br/infoteca/bitstream/doc/1172022/1/FL-Governanca-agrodados-2024.pdf Sources mostly agree there’s a problem with IoT data portability in Brazil], and [https://jota.info/opiniao-e-analise/artigos/data-act-da-uniao-europeia-um-modelo-de-regulacao-de-dados-12032024 some opinion pieces argue for a Data Act-style law], but no study shows that a Data Act copy is the fix. The Data Act’s efficacy is still unproven: [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained its rules have applied only since 2025], and there’s already academic pieces like [https://academic.oup.com/grurint/article/72/2/120/6754210 Kerber (2023) which argues that portability works mainly with detailed sectoral regulation].</div>

Paul Stein: /* Nature of data concerned */

2026-10-09T12:23:04Z

Nature of data concerned

← Older revision		Revision as of 14:23, 9 October 2026
Line 34:		Line 34:
	== Nature of data concerned ==		== Nature of data concerned ==
	=== <span class="s1">Key Characteristics of LGPD<br></span> ===		=== <span class="s1">Key Characteristics of LGPD<br></span> ===
	<p class="p1"><span class="s1">[https://www.dlapiperdataprotection.com/?t=law&c=BR#insight Lei Geral de Proteção de Dados (LGPD)]</span> is a Brazilian version of data protection law which resembles many characteristics of General Data Protection Regulation (GDPR) from the EU. LGPD is a '''general''', '''comprehensive, horizontal''' data privacy law which entered into force on September 18, 2020. It’s '''legally binding''' with National Data Protection Authority (ANPD) acting as an autonomous administrative authority to issue sanctions (penalties) for violations of the LGPD.</p>		<p class="p1" style="text-align: justify;" ><span class="s1">[https://www.dlapiperdataprotection.com/?t=law&c=BR#insight Lei Geral de Proteção de Dados (LGPD)]</span> is a Brazilian version of data protection law which resembles many characteristics of General Data Protection Regulation (GDPR) from the EU. LGPD is a '''general''', '''comprehensive, horizontal''' data privacy law which entered into force on September 18, 2020. It’s '''legally binding''' with National Data Protection Authority (ANPD) acting as an autonomous administrative authority to issue sanctions (penalties) for violations of the LGPD.</p>
	<p class="p1">From the <span class="s1">[https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf/@@display-file/file Article 18(V)]</span> of LGPD, it is stated that the portability of data to another service/product provider upon express request, '''according to the regulations of the national authority''', complying with trade and industrial secrets. Unlike GDPR Article 20 which provided detailed statutory conditions in terms of the scope of data and automated processing, LGPD renders <span class="s1">[https://wpcdn.idp.edu.br/idpsiteportal/2020/05/EN-CIPL-IDP-Paper-on-the-Role-of-the-ANPD-under-the-LGPD-04.16.20202.pdf ANPD the ultimate authority]</span> to define the regulatory framework on how to implement the right to data portability.</p>		<p class="p1" style="text-align: justify;" >From the <span class="s1">[https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf/@@display-file/file Article 18(V)]</span> of LGPD, it is stated that the portability of data to another service/product provider upon express request, '''according to the regulations of the national authority''', complying with trade and industrial secrets. Unlike GDPR Article 20 which provided detailed statutory conditions in terms of the scope of data and automated processing, LGPD renders <span class="s1">[https://wpcdn.idp.edu.br/idpsiteportal/2020/05/EN-CIPL-IDP-Paper-on-the-Role-of-the-ANPD-under-the-LGPD-04.16.20202.pdf ANPD the ultimate authority]</span> to define the regulatory framework on how to implement the right to data portability.</p>

	=== The Role of the ANPD ===		=== The Role of the ANPD ===
Line 47:		Line 47:
	Yet it is important to note that the [https://platformglossary.info/data-portability/ ANPD is not actually obliged] to come up with such regulatory guidelines. According to its regulatory agenda released in 2021, details regarding establishing interoperability standards are not even included on the list of regulatory initiatives to be tackled in the first two years of activities of ANPD.		Yet it is important to note that the [https://platformglossary.info/data-portability/ ANPD is not actually obliged] to come up with such regulatory guidelines. According to its regulatory agenda released in 2021, details regarding establishing interoperability standards are not even included on the list of regulatory initiatives to be tackled in the first two years of activities of ANPD.
	=== Scope of Application ===		=== Scope of Application ===
	<p class="p1">The LGPD is a horizontal law, applicable to processing by '''public and private legal persons''' (Article 3). Yet there are other sector-specific data portability regulatory frameworks in financial sector (Open finance framework from the Central Bank) and insurance sector (SUSEP) as well. <span class="s1">The LGPD has an </span><span class="s2">''''''</span>[https://www.linklaters.com/insights/data-protected/data-protected---brazil <span class="s2"><strong>extraterritorial </strong>reach</span><span class="s1">.</span>]<span class="s1"> </span>Under Article 3, a personal data processor is subject to the law when:</p>		<p class="p1" style="text-align: justify;" >The LGPD is a horizontal law, applicable to processing by '''public and private legal persons''' (Article 3). Yet there are other sector-specific data portability regulatory frameworks in financial sector (Open finance framework from the Central Bank) and insurance sector (SUSEP) as well. <span class="s1">The LGPD has an </span><span class="s2">''''''</span>[https://www.linklaters.com/insights/data-protected/data-protected---brazil <span class="s2"><strong>extraterritorial </strong>reach</span><span class="s1">.</span>]<span class="s1"> </span>Under Article 3, a personal data processor is subject to the law when:</p>
	#The data are either collected or processed within Brazil or		#The data are either collected or processed within Brazil or
	#The data is processed for the purpose of offering goods or services to individuals in Brazil.		#The data is processed for the purpose of offering goods or services to individuals in Brazil.

Paul Stein: /* IoT Data Portability */

2026-10-09T12:22:48Z

IoT Data Portability

← Older revision		Revision as of 14:22, 9 October 2026
Line 27:		Line 27:
	<div></div>		<div></div>
	<div>In terms of IoT data portability, in the case of Brazil, [https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d9854.htm no Brazilian law requires connected products to be designed so that users can pass that data to another provider easily], there’s not [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained EU Data Act] equivalent.</div>		<div>In terms of IoT data portability, in the case of Brazil, [https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d9854.htm no Brazilian law requires connected products to be designed so that users can pass that data to another provider easily], there’s not [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained EU Data Act] equivalent.</div>
	<div><br></div>		<div style="text-align: justify;" ><br></div>
	<div>Brazil relies instead on [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes], each of which obliges the companies it supervises to let customers move their data to a competitor, works only inside its own sector, and [https://normativos.bcb.gov.br/Lists/Normativos/Attachments/51028/Res_Conj_0001_v7_L.pdf almost always relies on the customer’s consent and standardised technical interfaces]. Examples are [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy, under which electricity distributors must let consumers share their smart-meter data with other suppliers], and [https://www.camara.leg.br/propostas-legislativas/2259727 the pending bill on agricultural data (PL 4123/2020)], [https://www.camara.leg.br/noticias/1213909-comissao-aprova-regras-para-proteger-dados-de-produtores-rurais/ which would do the same for farm machinery].</div>		<div style="text-align: justify;" >Brazil relies instead on [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes], each of which obliges the companies it supervises to let customers move their data to a competitor, works only inside its own sector, and [https://normativos.bcb.gov.br/Lists/Normativos/Attachments/51028/Res_Conj_0001_v7_L.pdf almost always relies on the customer’s consent and standardised technical interfaces]. Examples are [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy, under which electricity distributors must let consumers share their smart-meter data with other suppliers], and [https://www.camara.leg.br/propostas-legislativas/2259727 the pending bill on agricultural data (PL 4123/2020)], [https://www.camara.leg.br/noticias/1213909-comissao-aprova-regras-para-proteger-dados-de-produtores-rurais/ which would do the same for farm machinery].</div>
	<div><br></div>		<div style="text-align: justify;" ><br></div>
	<div>[https://www.infoteca.cnptia.embrapa.br/infoteca/bitstream/doc/1172022/1/FL-Governanca-agrodados-2024.pdf Sources mostly agree there’s a problem with IoT data portability in Brazil], and [https://jota.info/opiniao-e-analise/artigos/data-act-da-uniao-europeia-um-modelo-de-regulacao-de-dados-12032024 some opinion pieces argue for a Data Act-style law], but no study shows that a Data Act copy is the fix. The Data Act’s efficacy is still unproven: [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained its rules have applied only since 2025], and there’s already academic pieces like [https://academic.oup.com/grurint/article/72/2/120/6754210 Kerber (2023) which argues that portability works mainly with detailed sectoral regulation].</div>		<div>[https://www.infoteca.cnptia.embrapa.br/infoteca/bitstream/doc/1172022/1/FL-Governanca-agrodados-2024.pdf Sources mostly agree there’s a problem with IoT data portability in Brazil], and [https://jota.info/opiniao-e-analise/artigos/data-act-da-uniao-europeia-um-modelo-de-regulacao-de-dados-12032024 some opinion pieces argue for a Data Act-style law], but no study shows that a Data Act copy is the fix. The Data Act’s efficacy is still unproven: [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained its rules have applied only since 2025], and there’s already academic pieces like [https://academic.oup.com/grurint/article/72/2/120/6754210 Kerber (2023) which argues that portability works mainly with detailed sectoral regulation].</div>

Paul Stein: /* Data Portability beyond the LGPD */

2026-10-09T12:22:38Z

Data Portability beyond the LGPD

← Older revision		Revision as of 14:22, 9 October 2026
Line 16:		Line 16:
	<div></div>		<div></div>
	<div>In Brazil, there are also efforts towards an obligation of data portability, but its conception comes from [https://legalblogs.wolterskluwer.com/competition-blog/brazil-seeks-to-amend-its-competition-law-a-regulatory-model-a-la-allemande/ a different lens from that of the EU and its Digital Markets Act (DMA)], with [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets somewhat different objectives and mechanisms]. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The Bill No. 4675/2025 aims to amend the Brazilian Competition Law] so that CADE (Conselho Administrativo de Defesa Econômica), the competition authority, [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets can impose special rules on the largest digital companies], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm including, if it so decides, an obligation to allow data portability].</div>		<div>In Brazil, there are also efforts towards an obligation of data portability, but its conception comes from [https://legalblogs.wolterskluwer.com/competition-blog/brazil-seeks-to-amend-its-competition-law-a-regulatory-model-a-la-allemande/ a different lens from that of the EU and its Digital Markets Act (DMA)], with [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets somewhat different objectives and mechanisms]. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The Bill No. 4675/2025 aims to amend the Brazilian Competition Law] so that CADE (Conselho Administrativo de Defesa Econômica), the competition authority, [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets can impose special rules on the largest digital companies], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm including, if it so decides, an obligation to allow data portability].</div>
	<div><br></div>		<div style="text-align: justify;" ><br></div>
	<div>For data portability, [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE, on its own initiative or at the request of any interested party, decides whether a company is “systemically relevant”], [https://eur-lex.europa.eu/eli/reg/2022/1925/oj similar to a DMA gatekeeper]. Then, the organization decides if [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm “free data transfer tools for end users” (Article 47-E, V(a))] applies to the specific company. If imposed by CADE, [https://www.dataprivacybr.org/nota-tecnica-sobre-o-texto-substitutivo-ao-pl-4-675-2025-dep-aliel-machado/ the company builds the tool and users request transfers directly from it, CADE only supervises]. [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en Unlike the DMA, where portability applies automatically to every gatekeeper], here it can vary. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The provision covers both personal and non-personal data], [https://ejlt.org/index.php/ejlt/article/view/988 as the DMA does]. However, it doesn’t say whether data generated by the user’s activity is included and it doesn’t mention transfers to third parties either, or no requirements of real-time access [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en while the DMA does]. It also [https://www.techpolicy.press/building-trust-for-data-portability-within-the-dma-framework/ lacks rules on vetting recipients], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm makes coordination with the data protection authority optional, and needs about a year of procedure before any duty applies]. [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Personal data in any transfer remains subject to the LGPD].</div>		<div style="text-align: justify;" >For data portability, [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE, on its own initiative or at the request of any interested party, decides whether a company is “systemically relevant”], [https://eur-lex.europa.eu/eli/reg/2022/1925/oj similar to a DMA gatekeeper]. Then, the organization decides if [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm “free data transfer tools for end users” (Article 47-E, V(a))] applies to the specific company. If imposed by CADE, [https://www.dataprivacybr.org/nota-tecnica-sobre-o-texto-substitutivo-ao-pl-4-675-2025-dep-aliel-machado/ the company builds the tool and users request transfers directly from it, CADE only supervises]. [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en Unlike the DMA, where portability applies automatically to every gatekeeper], here it can vary. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The provision covers both personal and non-personal data], [https://ejlt.org/index.php/ejlt/article/view/988 as the DMA does]. However, it doesn’t say whether data generated by the user’s activity is included and it doesn’t mention transfers to third parties either, or no requirements of real-time access [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en while the DMA does]. It also [https://www.techpolicy.press/building-trust-for-data-portability-within-the-dma-framework/ lacks rules on vetting recipients], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm makes coordination with the data protection authority optional, and needs about a year of procedure before any duty applies]. [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Personal data in any transfer remains subject to the LGPD].</div>
	<div><br></div>		<div style="text-align: justify;" ><br></div>
	<div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm Only the private sector is affected; public bodies can merely ask CADE to act]. [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets Only very large holders are bound: groups with revenue above R$5 billion in Brazil or R$50 billion worldwide]. Small firms are never bound and are meant to benefit as recipients of users’ data. [https://eur-lex.europa.eu/eli/reg/2022/1925/oj Unlike the DMA, which designates each gatekeeper’s core platform services one by one], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm the bill measures size at the level of the whole group, and CADE may then limit obligations to specific services]. There are no fixed exceptions. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE “may consider” information security and the company’s other legal duties], and [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm for personal data the LGPD protects trade secrets and excludes anonymised data].</div>		<div style="text-align: justify;" >[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm Only the private sector is affected; public bodies can merely ask CADE to act]. [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets Only very large holders are bound: groups with revenue above R$5 billion in Brazil or R$50 billion worldwide]. Small firms are never bound and are meant to benefit as recipients of users’ data. [https://eur-lex.europa.eu/eli/reg/2022/1925/oj Unlike the DMA, which designates each gatekeeper’s core platform services one by one], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm the bill measures size at the level of the whole group, and CADE may then limit obligations to specific services]. There are no fixed exceptions. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE “may consider” information security and the company’s other legal duties], and [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm for personal data the LGPD protects trade secrets and excludes anonymised data].</div>
	<div><br></div>		<div style="text-align: justify;" ><br></div>
	<div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The objective of the proposed bill would be to reduce entry barriers and promote user choice] by weakening the data advantage of dominant platforms, [https://ejlt.org/index.php/ejlt/article/view/988 the same competition logic as the DMA]. Nevertheless, the main blind spot is that the bill creates a power for CADE, not a right for users. As a result, users’ portability will depend on which platform they use and what CADE decided for it. [https://telesintese.com.br/pl-dos-mercados-digitais-pode-ficar-para-2027/ As of October 2026, the bill had not been voted on].</div>		<div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The objective of the proposed bill would be to reduce entry barriers and promote user choice] by weakening the data advantage of dominant platforms, [https://ejlt.org/index.php/ejlt/article/view/988 the same competition logic as the DMA]. Nevertheless, the main blind spot is that the bill creates a power for CADE, not a right for users. As a result, users’ portability will depend on which platform they use and what CADE decided for it. [https://telesintese.com.br/pl-dos-mercados-digitais-pode-ficar-para-2027/ As of October 2026, the bill had not been voted on].</div>
	<div><br></div>		<div><br></div>

Paul Stein: /* Data Portability beyond the LGPD */

2026-10-09T12:22:20Z

Data Portability beyond the LGPD

← Older revision		Revision as of 14:22, 9 October 2026
Line 10:		Line 10:
	== Data Portability beyond the LGPD ==		== Data Portability beyond the LGPD ==
	=== Open Schemes ===		=== Open Schemes ===
	<div>[https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1/agenda-regulatoria-2025-2026/balanco-agenda-regulatoria-2025-2026-01-2026.pdf/@@display-file/file Because the ANPD has not yet settled the standards] that [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Article 40 of the LGPD] leaves to it, we cannot yet say how data portability will work in Brazil under the general law. Brazil does, however, already have working examples of portability, built sector by sector and often before the LGPD: [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes already facilitate portability of telephone numbers (Anatel), credit (Central Bank) and health plans (ANS)]. More recently, the same logic was extended to data itself through [https://www.cnnbrasil.com.br/economia/macroeconomia/veja-as-fases-do-open-banking-no-brasil-e-saiba-o-que-esperar-em-2022/ Open Finance (2021)], which [https://finsidersbrasil.com.br/economia-open/open-finance-gera-r-18-bi-em-operacoes-de-credito-aponta-bc/ had generated around R$18 billion in credit by the end of 2024], and [https://www.in.gov.br/en/web/dou/-/resolucao-cnsp-n-415-de-20-de-julho-de-2021-%20333272165 Open Insurance (2021)], with [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy to follow in 2027].</div>		<div>[https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1/agenda-regulatoria-2025-2026/balanco-agenda-regulatoria-2025-2026-01-2026.pdf/@@display-file/file Because the ANPD has not yet settled the standards] that [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Article 40 of the LGPD] leaves to it, we cannot yet say how data portability will work in Brazil under the general law. Brazil does, however, already have working examples of portability, built sector by sector and often before the LGPD:[https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes already facilitate portability of telephone numbers (Anatel), credit (Central Bank) and health plans (ANS)]. More recently, the same logic was extended to data itself through [https://www.cnnbrasil.com.br/economia/macroeconomia/veja-as-fases-do-open-banking-no-brasil-e-saiba-o-que-esperar-em-2022/ Open Finance (2021)], which [https://finsidersbrasil.com.br/economia-open/open-finance-gera-r-18-bi-em-operacoes-de-credito-aponta-bc/ had generated around R$18 billion in credit by the end of 2024], and [https://www.in.gov.br/en/web/dou/-/resolucao-cnsp-n-415-de-20-de-julho-de-2021-%20333272165 Open Insurance (2021)], with [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy to follow in 2027].</div>
	<div><br></div>		<div><br></div>

Paul Stein: /* Purpose and Objectives */

2026-10-09T12:19:50Z

Purpose and Objectives

← Older revision		Revision as of 14:19, 9 October 2026
Line 1:		Line 1:
	= Purpose and Objectives =		== Purpose and Objectives ==
	=== Purpose and ~~Objectives~~ ===		=== Purpose and Objectives ===
	<p style="text-align: justify;">The LGPD is [https://e-legis.camara.leg.br/cefor/index.php/e-legis/article/download/500/689/2629 frequently] [https://reference-global.com/article/10.2478/iclr-2022-0016 described] as a legal transplant of the GDPR to the Brazilian context. However, there are significant differences between the two regulations where it relates to purpose and objective. Where the GDPR [https://gdpr-info.eu/art-1-gdpr/ explicitly prioritizes] the dual objectives of fundamental rights of citizens and the free movement of personal data, [https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf/@@display-file/file Article 2 of the LGPD] defines a broader set of objectives including “free enterprise, free competition and consumer protection” as well as “economic and technological development and innovation”.  </p><p style="text-align: justify;">This is especially noteworthy in context of the LGPD’s equivalent of Article 20 GDPR: the right to data portability (Article 18(V) LGPD). Though Article 18 LGPD lacks Article 20 GDPR’s stipulation that data controllers must permit data portability “without hindrance from the controller”, the explicit framing in Article 2(VI) LGPD implies a pro-competitive reading of Article 18(V) LGPD.</p><p style="text-align: justify;">The “economic development” objective is further apparent in the geopolitical interests that may have in part driven the drafting of the LGPD: specifically a desire to join the OECD as a full-fledged member. Accession requires compliance with OECD guidelines, including the “[https://www.oecd.org/en/about/data-protection.html OECD Privacy Guidelines]”. In this regard, the LGPD appears to have been successful, as accession talks were officially [https://www.oecd.org/en/publications/development-co-operation-profiles_04b376d7-en/brazil_f5c1fbdb-en.html initiated in 2022]. This was evidently of lesser concern in the EU, as 22 of its 28 member states were already OECD members at the time the GDPR was drafted. </p>		<p style="text-align: justify;">The LGPD is [https://e-legis.camara.leg.br/cefor/index.php/e-legis/article/download/500/689/2629 frequently] [https://reference-global.com/article/10.2478/iclr-2022-0016 described] as a legal transplant of the GDPR to the Brazilian context. However, there are significant differences between the two regulations where it relates to purpose and objective. Where the GDPR [https://gdpr-info.eu/art-1-gdpr/ explicitly prioritizes] the dual objectives of fundamental rights of citizens and the free movement of personal data, [https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf/@@display-file/file Article 2 of the LGPD] defines a broader set of objectives including “free enterprise, free competition and consumer protection” as well as “economic and technological development and innovation”.  </p>
			<p style="text-align: justify;">This is especially noteworthy in context of the LGPD’s equivalent of Article 20 GDPR: the right to data portability (Article 18(V) LGPD). Though Article 18 LGPD lacks Article 20 GDPR’s stipulation that data controllers must permit data portability “without hindrance from the controller”, the explicit framing in Article 2(VI) LGPD implies a pro-competitive reading of Article 18(V) LGPD.</p>
			<p style="text-align: justify;">The “economic development” objective is further apparent in the geopolitical interests that may have in part driven the drafting of the LGPD: specifically a desire to join the OECD as a full-fledged member. Accession requires compliance with OECD guidelines, including the “[https://www.oecd.org/en/about/data-protection.html OECD Privacy Guidelines]”. In this regard, the LGPD appears to have been successful, as accession talks were officially [https://www.oecd.org/en/publications/development-co-operation-profiles_04b376d7-en/brazil_f5c1fbdb-en.html initiated in 2022]. This was evidently of lesser concern in the EU, as 22 of its 28 member states were already OECD members at the time the GDPR was drafted. </p>

	=== Legislative Competence and Constitutional Status ===		=== Legislative Competence and Constitutional Status ===
	<p style="text-align: justify;">Similar to the European Union, Brazil’s system of government features exclusive and shared competences. Both systems divide legislative competence between exclusive and shared categories. In the EU, these are set out in Articles 3 and 4 TFEU, which have not been amended since the Lisbon Treaty and do not expressly list data protection; the Union's legislative basis is instead [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_16/oj/eng Article 16(2) TFEU]. In Brazil, [https://legis.senado.leg.br/norma/35485358 Constitutional Amendment 115/2022] added item XXX to Article 22 of the Constitution, placing the protection and processing of personal data within the Union's privative legislative competence. The same amendment made data protection a fundamental right, which the Supreme Federal Court had already recognized as implicit since at least 2020. The same amendment also made data protection a fundamental right, though the Supreme Federal Court of Brazil (Supremo Tribunal Federal) had already treated the right as implicit for several years at that point. In summary, both LGPD and GDPR are congruent in their basis in fundamental rights, but distinct in their respective complementary goals of pro-consumer economic-developmental logic (LGPD) and internal market integration (GDPR).</p>		<p style="text-align: justify;">Similar to the European Union, Brazil’s system of government features exclusive and shared competences. Both systems divide legislative competence between exclusive and shared categories. In the EU, these are set out in Articles 3 and 4 TFEU, which have not been amended since the Lisbon Treaty and do not expressly list data protection; the Union's legislative basis is instead [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_16/oj/eng Article 16(2) TFEU]. In Brazil, [https://legis.senado.leg.br/norma/35485358 Constitutional Amendment 115/2022] added item XXX to Article 22 of the Constitution, placing the protection and processing of personal data within the Union's privative legislative competence. The same amendment made data protection a fundamental right, which the Supreme Federal Court had already recognized as implicit since at least 2020. The same amendment also made data protection a fundamental right, though the Supreme Federal Court of Brazil (Supremo Tribunal Federal) had already treated the right as implicit for several years at that point. In summary, both LGPD and GDPR are congruent in their basis in fundamental rights, but distinct in their respective complementary goals of pro-consumer economic-developmental logic (LGPD) and internal market integration (GDPR).</p>

	== Data Portability beyond the LGPD ==		== Data Portability beyond the LGPD ==
	=== Open Schemes ===		=== Open Schemes ===
Line 51:		Line 55:
	=== Legal Framework and Sectoral Regimes ===		=== Legal Framework and Sectoral Regimes ===
	<p class="p1" style="text-align: justify;">Brazilian data portability rests on distinct instruments. The [https://www.planalto.gov.br/ccivil_03/constituicao/constituicaocompilado.html Constitution, article 5(LXXIX)], protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as [https://www.bcb.gov.br/content/config/Documents/Open_Banking_CMN_BCB_Joint_Resolution_1_2020.pdf amended by 4/2022;] insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under [https://www.gov.br/aneel/pt-br/assuntos/noticias/2025-defeso-eleitoral/aprovada-consulta-para-aperfeicoar-regras-dos-servicos-de-distribuicao-em-consequencia-da-abertura-do-mercado-para-consumidores-do-grupo-a/ Public Consultation 7/2025]. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.</p>		<p class="p1" style="text-align: justify;">Brazilian data portability rests on distinct instruments. The [https://www.planalto.gov.br/ccivil_03/constituicao/constituicaocompilado.html Constitution, article 5(LXXIX)], protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as [https://www.bcb.gov.br/content/config/Documents/Open_Banking_CMN_BCB_Joint_Resolution_1_2020.pdf amended by 4/2022;] insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under [https://www.gov.br/aneel/pt-br/assuntos/noticias/2025-defeso-eleitoral/aprovada-consulta-para-aperfeicoar-regras-dos-servicos-de-distribuicao-em-consequencia-da-abertura-do-mercado-para-consumidores-do-grupo-a/ Public Consultation 7/2025]. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.</p>

	=== Assessment and Policy Priorities ===		=== Assessment and Policy Priorities ===
	<p class="p1" style="text-align: justify;">From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the [https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1 ANPD still listed] regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.</p><p class="p1" style="text-align: justify;">For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. [https://www.bis.org/publications/paper-168-opening-doors-open-finance-evidence-international-experience Research] identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. [https://www.cgap.org/blog/success-in-open-finance-requires-trust-lessons-brazil Survey findings ]associate lower income with lower reported adoption, without establishing national causal effects. [https://doi.org/10.1016/j.jfineco.2022.12.003 Economic theory] additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. [//doi.org/10.1108/IJOEM-07-2025-1439 Technical standardisation] therefore requires public oversight, not merely industry agreement. </p><p class="p1" style="text-align: justify;">Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established.</p>		<p class="p1" style="text-align: justify;">From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the [https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1 ANPD still listed] regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.</p>
			<p class="p1" style="text-align: justify;">For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. [https://www.bis.org/publications/paper-168-opening-doors-open-finance-evidence-international-experience Research] identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. [https://www.cgap.org/blog/success-in-open-finance-requires-trust-lessons-brazil Survey findings ]associate lower income with lower reported adoption, without establishing national causal effects. [https://doi.org/10.1016/j.jfineco.2022.12.003 Economic theory] additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. [//doi.org/10.1108/IJOEM-07-2025-1439 Technical standardisation] therefore requires public oversight, not merely industry agreement. </p>
			<p class="p1" style="text-align: justify;">Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established.</p>

Paul Stein: /* Data Portability beyond the LGPD */

2026-10-09T12:19:05Z

Data Portability beyond the LGPD

← Older revision		Revision as of 14:19, 9 October 2026
Line 6:		Line 6:
	== Data Portability beyond the LGPD ==		== Data Portability beyond the LGPD ==
	=== Open Schemes ===		=== Open Schemes ===
	~~<div><br></div>~~<div>[https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1/agenda-regulatoria-2025-2026/balanco-agenda-regulatoria-2025-2026-01-2026.pdf/@@display-file/file Because the ANPD has not yet settled the standards] that [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Article 40 of the LGPD] leaves to it, we cannot yet say how data portability will work in Brazil under the general law. Brazil does, however, already have working examples of portability, built sector by sector and often before the LGPD: [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes already facilitate portability of telephone numbers (Anatel), credit (Central Bank) and health plans (ANS)]. More recently, the same logic was extended to data itself through [https://www.cnnbrasil.com.br/economia/macroeconomia/veja-as-fases-do-open-banking-no-brasil-e-saiba-o-que-esperar-em-2022/ Open Finance (2021)], which [https://finsidersbrasil.com.br/economia-open/open-finance-gera-r-18-bi-em-operacoes-de-credito-aponta-bc/ had generated around R$18 billion in credit by the end of 2024], and [https://www.in.gov.br/en/web/dou/-/resolucao-cnsp-n-415-de-20-de-julho-de-2021-%20333272165 Open Insurance (2021)], with [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy to follow in 2027].</div><div><br></div>		<div>[https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1/agenda-regulatoria-2025-2026/balanco-agenda-regulatoria-2025-2026-01-2026.pdf/@@display-file/file Because the ANPD has not yet settled the standards] that [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Article 40 of the LGPD] leaves to it, we cannot yet say how data portability will work in Brazil under the general law. Brazil does, however, already have working examples of portability, built sector by sector and often before the LGPD: [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes already facilitate portability of telephone numbers (Anatel), credit (Central Bank) and health plans (ANS)]. More recently, the same logic was extended to data itself through [https://www.cnnbrasil.com.br/economia/macroeconomia/veja-as-fases-do-open-banking-no-brasil-e-saiba-o-que-esperar-em-2022/ Open Finance (2021)], which [https://finsidersbrasil.com.br/economia-open/open-finance-gera-r-18-bi-em-operacoes-de-credito-aponta-bc/ had generated around R$18 billion in credit by the end of 2024], and [https://www.in.gov.br/en/web/dou/-/resolucao-cnsp-n-415-de-20-de-julho-de-2021-%20333272165 Open Insurance (2021)], with [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy to follow in 2027].</div>
			<div><br></div>

	=== Competition-Based Portability: Bill No. 4675/2025 ===		=== Competition-Based Portability: Bill No. 4675/2025 ===
	<div></div><div>In Brazil, there are also efforts towards an obligation of data portability, but its conception comes from [https://legalblogs.wolterskluwer.com/competition-blog/brazil-seeks-to-amend-its-competition-law-a-regulatory-model-a-la-allemande/ a different lens from that of the EU and its Digital Markets Act (DMA)], with [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets somewhat different objectives and mechanisms].~~</div><div><br></div><div>~~[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The Bill No. 4675/2025 aims to amend the Brazilian Competition Law] so that CADE (Conselho Administrativo de Defesa Econômica), the competition authority, [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets can impose special rules on the largest digital companies], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm including, if it so decides, an obligation to allow data portability].</div><div><br></div><div>For data portability, [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE, on its own initiative or at the request of any interested party, decides whether a company is “systemically relevant”], [https://eur-lex.europa.eu/eli/reg/2022/1925/oj similar to a DMA gatekeeper]. Then, the organization decides if [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm “free data transfer tools for end users” (Article 47-E, V(a))] applies to the specific company. If imposed by CADE, [https://www.dataprivacybr.org/nota-tecnica-sobre-o-texto-substitutivo-ao-pl-4-675-2025-dep-aliel-machado/ the company builds the tool and users request transfers directly from it, CADE only supervises]. [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en Unlike the DMA, where portability applies automatically to every gatekeeper], here it can vary.~~</div><div><br></div><div>~~[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The provision covers both personal and non-personal data], [https://ejlt.org/index.php/ejlt/article/view/988 as the DMA does]. However, it doesn’t say whether data generated by the user’s activity is included and it doesn’t mention transfers to third parties either, or no requirements of real-time access [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en while the DMA does]. It also [https://www.techpolicy.press/building-trust-for-data-portability-within-the-dma-framework/ lacks rules on vetting recipients], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm makes coordination with the data protection authority optional, and needs about a year of procedure before any duty applies]. [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Personal data in any transfer remains subject to the LGPD].</div><div><br></div><div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm Only the private sector is affected; public bodies can merely ask CADE to act]. [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets Only very large holders are bound: groups with revenue above R$5 billion in Brazil or R$50 billion worldwide]. Small firms are never bound and are meant to benefit as recipients of users’ data. [https://eur-lex.europa.eu/eli/reg/2022/1925/oj Unlike the DMA, which designates each gatekeeper’s core platform services one by one], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm the bill measures size at the level of the whole group, and CADE may then limit obligations to specific services].~~</div><div><br></div><div>~~There are no fixed exceptions. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE “may consider” information security and the company’s other legal duties], and [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm for personal data the LGPD protects trade secrets and excludes anonymised data].</div><div><br></div><div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The objective of the proposed bill would be to reduce entry barriers and promote user choice] by weakening the data advantage of dominant platforms, [https://ejlt.org/index.php/ejlt/article/view/988 the same competition logic as the DMA]. Nevertheless, the main blind spot is that the bill creates a power for CADE, not a right for users. As a result, users’ portability will depend on which platform they use and what CADE decided for it. [https://telesintese.com.br/pl-dos-mercados-digitais-pode-ficar-para-2027/ As of October 2026, the bill had not been voted on].</div><div><br></div>		<div></div>
			<div>In Brazil, there are also efforts towards an obligation of data portability, but its conception comes from [https://legalblogs.wolterskluwer.com/competition-blog/brazil-seeks-to-amend-its-competition-law-a-regulatory-model-a-la-allemande/ a different lens from that of the EU and its Digital Markets Act (DMA)], with [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets somewhat different objectives and mechanisms]. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The Bill No. 4675/2025 aims to amend the Brazilian Competition Law] so that CADE (Conselho Administrativo de Defesa Econômica), the competition authority, [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets can impose special rules on the largest digital companies], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm including, if it so decides, an obligation to allow data portability].</div>
			<div><br></div>
			<div>For data portability, [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE, on its own initiative or at the request of any interested party, decides whether a company is “systemically relevant”], [https://eur-lex.europa.eu/eli/reg/2022/1925/oj similar to a DMA gatekeeper]. Then, the organization decides if [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm “free data transfer tools for end users” (Article 47-E, V(a))] applies to the specific company. If imposed by CADE, [https://www.dataprivacybr.org/nota-tecnica-sobre-o-texto-substitutivo-ao-pl-4-675-2025-dep-aliel-machado/ the company builds the tool and users request transfers directly from it, CADE only supervises]. [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en Unlike the DMA, where portability applies automatically to every gatekeeper], here it can vary. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The provision covers both personal and non-personal data], [https://ejlt.org/index.php/ejlt/article/view/988 as the DMA does]. However, it doesn’t say whether data generated by the user’s activity is included and it doesn’t mention transfers to third parties either, or no requirements of real-time access [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en while the DMA does]. It also [https://www.techpolicy.press/building-trust-for-data-portability-within-the-dma-framework/ lacks rules on vetting recipients], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm makes coordination with the data protection authority optional, and needs about a year of procedure before any duty applies]. [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Personal data in any transfer remains subject to the LGPD].</div>
			<div><br></div>
			<div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm Only the private sector is affected; public bodies can merely ask CADE to act]. [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets Only very large holders are bound: groups with revenue above R$5 billion in Brazil or R$50 billion worldwide]. Small firms are never bound and are meant to benefit as recipients of users’ data. [https://eur-lex.europa.eu/eli/reg/2022/1925/oj Unlike the DMA, which designates each gatekeeper’s core platform services one by one], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm the bill measures size at the level of the whole group, and CADE may then limit obligations to specific services]. There are no fixed exceptions. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE “may consider” information security and the company’s other legal duties], and [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm for personal data the LGPD protects trade secrets and excludes anonymised data].</div>
			<div><br></div>
			<div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The objective of the proposed bill would be to reduce entry barriers and promote user choice] by weakening the data advantage of dominant platforms, [https://ejlt.org/index.php/ejlt/article/view/988 the same competition logic as the DMA]. Nevertheless, the main blind spot is that the bill creates a power for CADE, not a right for users. As a result, users’ portability will depend on which platform they use and what CADE decided for it. [https://telesintese.com.br/pl-dos-mercados-digitais-pode-ficar-para-2027/ As of October 2026, the bill had not been voted on].</div>
			<div><br></div>

	=== IoT Data Portability ===		=== IoT Data Portability ===
	<div></div><div>In terms of IoT data portability, in the case of Brazil, [https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d9854.htm no Brazilian law requires connected products to be designed so that users can pass that data to another provider easily], there’s not [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained EU Data Act] equivalent.</div><div><br></div><div>Brazil relies instead on [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes], each of which obliges the companies it supervises to let customers move their data to a competitor, works only inside its own sector, and [https://normativos.bcb.gov.br/Lists/Normativos/Attachments/51028/Res_Conj_0001_v7_L.pdf almost always relies on the customer’s consent and standardised technical interfaces]. Examples are [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy, under which electricity distributors must let consumers share their smart-meter data with other suppliers], and [https://www.camara.leg.br/propostas-legislativas/2259727 the pending bill on agricultural data (PL 4123/2020)], [https://www.camara.leg.br/noticias/1213909-comissao-aprova-regras-para-proteger-dados-de-produtores-rurais/ which would do the same for farm machinery].</div><div><br></div><div>[https://www.infoteca.cnptia.embrapa.br/infoteca/bitstream/doc/1172022/1/FL-Governanca-agrodados-2024.pdf Sources mostly agree there’s a problem with IoT data portability in Brazil], and [https://jota.info/opiniao-e-analise/artigos/data-act-da-uniao-europeia-um-modelo-de-regulacao-de-dados-12032024 some opinion pieces argue for a Data Act-style law], but no study shows that a Data Act copy is the fix. The Data Act’s efficacy is still unproven: [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained its rules have applied only since 2025], and there’s already academic pieces like [https://academic.oup.com/grurint/article/72/2/120/6754210 Kerber (2023) which argues that portability works mainly with detailed sectoral regulation].~~</div><div><br></div><div>607~~</div>		<div></div>
			<div>In terms of IoT data portability, in the case of Brazil, [https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d9854.htm no Brazilian law requires connected products to be designed so that users can pass that data to another provider easily], there’s not [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained EU Data Act] equivalent.</div>
			<div><br></div>
			<div>Brazil relies instead on [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes], each of which obliges the companies it supervises to let customers move their data to a competitor, works only inside its own sector, and [https://normativos.bcb.gov.br/Lists/Normativos/Attachments/51028/Res_Conj_0001_v7_L.pdf almost always relies on the customer’s consent and standardised technical interfaces]. Examples are [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy, under which electricity distributors must let consumers share their smart-meter data with other suppliers], and [https://www.camara.leg.br/propostas-legislativas/2259727 the pending bill on agricultural data (PL 4123/2020)], [https://www.camara.leg.br/noticias/1213909-comissao-aprova-regras-para-proteger-dados-de-produtores-rurais/ which would do the same for farm machinery].</div>
			<div><br></div>
			<div>[https://www.infoteca.cnptia.embrapa.br/infoteca/bitstream/doc/1172022/1/FL-Governanca-agrodados-2024.pdf Sources mostly agree there’s a problem with IoT data portability in Brazil], and [https://jota.info/opiniao-e-analise/artigos/data-act-da-uniao-europeia-um-modelo-de-regulacao-de-dados-12032024 some opinion pieces argue for a Data Act-style law], but no study shows that a Data Act copy is the fix. The Data Act’s efficacy is still unproven: [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained its rules have applied only since 2025], and there’s already academic pieces like [https://academic.oup.com/grurint/article/72/2/120/6754210 Kerber (2023) which argues that portability works mainly with detailed sectoral regulation].</div>

	== Nature of data concerned ==		== Nature of data concerned ==

Paul Stein: /* Purpose and Objectives */

2026-10-09T12:18:04Z

Purpose and Objectives

← Older revision		Revision as of 14:18, 9 October 2026
Line 1:		Line 1:
	== Purpose and Objectives ==		= Purpose and Objectives =
	~~<h3 class~~=~~"mwt-heading" style~~=~~"text-align: justify;" >~~Purpose and ~~Objectives </h3>~~		=== Purpose and Objectives ===
	<p style="text-align: justify;">The LGPD is [https://e-legis.camara.leg.br/cefor/index.php/e-legis/article/download/500/689/2629 frequently] [https://reference-global.com/article/10.2478/iclr-2022-0016 described] as a legal transplant of the GDPR to the Brazilian context. However, there are significant differences between the two regulations where it relates to purpose and objective. Where the GDPR [https://gdpr-info.eu/art-1-gdpr/ explicitly prioritizes] the dual objectives of fundamental rights of citizens and the free movement of personal data, [https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf/@@display-file/file Article 2 of the LGPD] defines a broader set of objectives including “free enterprise, free competition and consumer protection” as well as “economic and technological development and innovation”.  </p>		<p style="text-align: justify;">The LGPD is [https://e-legis.camara.leg.br/cefor/index.php/e-legis/article/download/500/689/2629 frequently] [https://reference-global.com/article/10.2478/iclr-2022-0016 described] as a legal transplant of the GDPR to the Brazilian context. However, there are significant differences between the two regulations where it relates to purpose and objective. Where the GDPR [https://gdpr-info.eu/art-1-gdpr/ explicitly prioritizes] the dual objectives of fundamental rights of citizens and the free movement of personal data, [https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf/@@display-file/file Article 2 of the LGPD] defines a broader set of objectives including “free enterprise, free competition and consumer protection” as well as “economic and technological development and innovation”.  </p><p style="text-align: justify;">This is especially noteworthy in context of the LGPD’s equivalent of Article 20 GDPR: the right to data portability (Article 18(V) LGPD). Though Article 18 LGPD lacks Article 20 GDPR’s stipulation that data controllers must permit data portability “without hindrance from the controller”, the explicit framing in Article 2(VI) LGPD implies a pro-competitive reading of Article 18(V) LGPD.</p><p style="text-align: justify;">The “economic development” objective is further apparent in the geopolitical interests that may have in part driven the drafting of the LGPD: specifically a desire to join the OECD as a full-fledged member. Accession requires compliance with OECD guidelines, including the “[https://www.oecd.org/en/about/data-protection.html OECD Privacy Guidelines]”. In this regard, the LGPD appears to have been successful, as accession talks were officially [https://www.oecd.org/en/publications/development-co-operation-profiles_04b376d7-en/brazil_f5c1fbdb-en.html initiated in 2022]. This was evidently of lesser concern in the EU, as 22 of its 28 member states were already OECD members at the time the GDPR was drafted. </p>
	<p style="text-align: justify;">This is especially noteworthy in context of the LGPD’s equivalent of Article 20 GDPR: the right to data portability (Article 18(V) LGPD). Though Article 18 LGPD lacks Article 20 GDPR’s stipulation that data controllers must permit data portability “without hindrance from the controller”, the explicit framing in Article 2(VI) LGPD implies a pro-competitive reading of Article 18(V) LGPD.</p>		=== Legislative Competence and Constitutional Status ===
	<p style="text-align: justify;">The “economic development” objective is further apparent in the geopolitical interests that may have in part driven the drafting of the LGPD: specifically a desire to join the OECD as a full-fledged member. Accession requires compliance with OECD guidelines, including the “[https://www.oecd.org/en/about/data-protection.html OECD Privacy Guidelines]”. In this regard, the LGPD appears to have been successful, as accession talks were officially [https://www.oecd.org/en/publications/development-co-operation-profiles_04b376d7-en/brazil_f5c1fbdb-en.html initiated in 2022]. This was evidently of lesser concern in the EU, as 22 of its 28 member states were already OECD members at the time the GDPR was drafted. </p>
	~~<h3 class~~=~~"mwt-heading" style~~=~~"text-align: justify;" >~~Legislative Competence and Constitutional Status~~</h3>~~
	<p style="text-align: justify;">Similar to the European Union, Brazil’s system of government features exclusive and shared competences. Both systems divide legislative competence between exclusive and shared categories. In the EU, these are set out in Articles 3 and 4 TFEU, which have not been amended since the Lisbon Treaty and do not expressly list data protection; the Union's legislative basis is instead [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_16/oj/eng Article 16(2) TFEU]. In Brazil, [https://legis.senado.leg.br/norma/35485358 Constitutional Amendment 115/2022] added item XXX to Article 22 of the Constitution, placing the protection and processing of personal data within the Union's privative legislative competence. The same amendment made data protection a fundamental right, which the Supreme Federal Court had already recognized as implicit since at least 2020. The same amendment also made data protection a fundamental right, though the Supreme Federal Court of Brazil (Supremo Tribunal Federal) had already treated the right as implicit for several years at that point. In summary, both LGPD and GDPR are congruent in their basis in fundamental rights, but distinct in their respective complementary goals of pro-consumer economic-developmental logic (LGPD) and internal market integration (GDPR).</p>		<p style="text-align: justify;">Similar to the European Union, Brazil’s system of government features exclusive and shared competences. Both systems divide legislative competence between exclusive and shared categories. In the EU, these are set out in Articles 3 and 4 TFEU, which have not been amended since the Lisbon Treaty and do not expressly list data protection; the Union's legislative basis is instead [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_16/oj/eng Article 16(2) TFEU]. In Brazil, [https://legis.senado.leg.br/norma/35485358 Constitutional Amendment 115/2022] added item XXX to Article 22 of the Constitution, placing the protection and processing of personal data within the Union's privative legislative competence. The same amendment made data protection a fundamental right, which the Supreme Federal Court had already recognized as implicit since at least 2020. The same amendment also made data protection a fundamental right, though the Supreme Federal Court of Brazil (Supremo Tribunal Federal) had already treated the right as implicit for several years at that point. In summary, both LGPD and GDPR are congruent in their basis in fundamental rights, but distinct in their respective complementary goals of pro-consumer economic-developmental logic (LGPD) and internal market integration (GDPR).</p>
			== Data Portability beyond the LGPD ==
			=== Open Schemes ===
			<div><br></div><div>[https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1/agenda-regulatoria-2025-2026/balanco-agenda-regulatoria-2025-2026-01-2026.pdf/@@display-file/file Because the ANPD has not yet settled the standards] that [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Article 40 of the LGPD] leaves to it, we cannot yet say how data portability will work in Brazil under the general law. Brazil does, however, already have working examples of portability, built sector by sector and often before the LGPD: [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes already facilitate portability of telephone numbers (Anatel), credit (Central Bank) and health plans (ANS)]. More recently, the same logic was extended to data itself through [https://www.cnnbrasil.com.br/economia/macroeconomia/veja-as-fases-do-open-banking-no-brasil-e-saiba-o-que-esperar-em-2022/ Open Finance (2021)], which [https://finsidersbrasil.com.br/economia-open/open-finance-gera-r-18-bi-em-operacoes-de-credito-aponta-bc/ had generated around R$18 billion in credit by the end of 2024], and [https://www.in.gov.br/en/web/dou/-/resolucao-cnsp-n-415-de-20-de-julho-de-2021-%20333272165 Open Insurance (2021)], with [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy to follow in 2027].</div><div><br></div>
			=== Competition-Based Portability: Bill No. 4675/2025 ===
			<div></div><div>In Brazil, there are also efforts towards an obligation of data portability, but its conception comes from [https://legalblogs.wolterskluwer.com/competition-blog/brazil-seeks-to-amend-its-competition-law-a-regulatory-model-a-la-allemande/ a different lens from that of the EU and its Digital Markets Act (DMA)], with [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets somewhat different objectives and mechanisms].</div><div><br></div><div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The Bill No. 4675/2025 aims to amend the Brazilian Competition Law] so that CADE (Conselho Administrativo de Defesa Econômica), the competition authority, [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets can impose special rules on the largest digital companies], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm including, if it so decides, an obligation to allow data portability].</div><div><br></div><div>For data portability, [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE, on its own initiative or at the request of any interested party, decides whether a company is “systemically relevant”], [https://eur-lex.europa.eu/eli/reg/2022/1925/oj similar to a DMA gatekeeper]. Then, the organization decides if [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm “free data transfer tools for end users” (Article 47-E, V(a))] applies to the specific company. If imposed by CADE, [https://www.dataprivacybr.org/nota-tecnica-sobre-o-texto-substitutivo-ao-pl-4-675-2025-dep-aliel-machado/ the company builds the tool and users request transfers directly from it, CADE only supervises]. [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en Unlike the DMA, where portability applies automatically to every gatekeeper], here it can vary.</div><div><br></div><div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The provision covers both personal and non-personal data], [https://ejlt.org/index.php/ejlt/article/view/988 as the DMA does]. However, it doesn’t say whether data generated by the user’s activity is included and it doesn’t mention transfers to third parties either, or no requirements of real-time access [https://digital-markets-act.ec.europa.eu/businesses-portal/end-user-data-portability_en while the DMA does]. It also [https://www.techpolicy.press/building-trust-for-data-portability-within-the-dma-framework/ lacks rules on vetting recipients], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm makes coordination with the data protection authority optional, and needs about a year of procedure before any duty applies]. [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Personal data in any transfer remains subject to the LGPD].</div><div><br></div><div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm Only the private sector is affected; public bodies can merely ask CADE to act]. [https://www.csis.org/blogs/charting-geoeconomics/unpacking-brazils-latest-effort-regulate-digital-markets Only very large holders are bound: groups with revenue above R$5 billion in Brazil or R$50 billion worldwide]. Small firms are never bound and are meant to benefit as recipients of users’ data. [https://eur-lex.europa.eu/eli/reg/2022/1925/oj Unlike the DMA, which designates each gatekeeper’s core platform services one by one], [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm the bill measures size at the level of the whole group, and CADE may then limit obligations to specific services].</div><div><br></div><div>There are no fixed exceptions. [https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm CADE “may consider” information security and the company’s other legal duties], and [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm for personal data the LGPD protects trade secrets and excludes anonymised data].</div><div><br></div><div>[https://www.planalto.gov.br/CCIVIL_03/Projetos/Ato_2023_2026/2025/PL/pl-4675.htm The objective of the proposed bill would be to reduce entry barriers and promote user choice] by weakening the data advantage of dominant platforms, [https://ejlt.org/index.php/ejlt/article/view/988 the same competition logic as the DMA]. Nevertheless, the main blind spot is that the bill creates a power for CADE, not a right for users. As a result, users’ portability will depend on which platform they use and what CADE decided for it. [https://telesintese.com.br/pl-dos-mercados-digitais-pode-ficar-para-2027/ As of October 2026, the bill had not been voted on].</div><div><br></div>
			=== IoT Data Portability ===
			<div></div><div>In terms of IoT data portability, in the case of Brazil, [https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d9854.htm no Brazilian law requires connected products to be designed so that users can pass that data to another provider easily], there’s not [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained EU Data Act] equivalent.</div><div><br></div><div>Brazil relies instead on [https://www.scielo.br/j/rec/a/z97cgKn8X3vnGyW87B4Dpjj/?lang=en sectoral schemes], each of which obliges the companies it supervises to let customers move their data to a competitor, works only inside its own sector, and [https://normativos.bcb.gov.br/Lists/Normativos/Attachments/51028/Res_Conj_0001_v7_L.pdf almost always relies on the customer’s consent and standardised technical interfaces]. Examples are [https://cenarioenergia.com.br/2026/06/30/open-energy-aneel-define-regras-para-portabilidade-de-dados-no-mercado-livre-ate-2028/ Open Energy, under which electricity distributors must let consumers share their smart-meter data with other suppliers], and [https://www.camara.leg.br/propostas-legislativas/2259727 the pending bill on agricultural data (PL 4123/2020)], [https://www.camara.leg.br/noticias/1213909-comissao-aprova-regras-para-proteger-dados-de-produtores-rurais/ which would do the same for farm machinery].</div><div><br></div><div>[https://www.infoteca.cnptia.embrapa.br/infoteca/bitstream/doc/1172022/1/FL-Governanca-agrodados-2024.pdf Sources mostly agree there’s a problem with IoT data portability in Brazil], and [https://jota.info/opiniao-e-analise/artigos/data-act-da-uniao-europeia-um-modelo-de-regulacao-de-dados-12032024 some opinion pieces argue for a Data Act-style law], but no study shows that a Data Act copy is the fix. The Data Act’s efficacy is still unproven: [https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained its rules have applied only since 2025], and there’s already academic pieces like [https://academic.oup.com/grurint/article/72/2/120/6754210 Kerber (2023) which argues that portability works mainly with detailed sectoral regulation].</div><div><br></div><div>607</div>

	== Nature of data concerned ==		== Nature of data concerned ==

Paul Stein: /* Structure and Effectiveness of Brazilian Data Portability Regulation */

2026-10-08T14:39:01Z

Structure and Effectiveness of Brazilian Data Portability Regulation

← Older revision		Revision as of 16:39, 8 October 2026
Line 28:		Line 28:

	== Structure and Effectiveness of Brazilian Data Portability Regulation ==		== Structure and Effectiveness of Brazilian Data Portability Regulation ==
	~~<h3 class~~=~~"p1 mwt-heading" style~~=~~"text-align: justify;" >~~Legal Framework and Sectoral Regimes~~</h3>~~		=== Legal Framework and Sectoral Regimes ===
	<p class="p1" style="text-align: justify;">Brazilian data portability rests on distinct instruments. The [https://www.planalto.gov.br/ccivil_03/constituicao/constituicaocompilado.html Constitution, article 5(LXXIX)], protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as [https://www.bcb.gov.br/content/config/Documents/Open_Banking_CMN_BCB_Joint_Resolution_1_2020.pdf amended by 4/2022;] insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under [https://www.gov.br/aneel/pt-br/assuntos/noticias/2025-defeso-eleitoral/aprovada-consulta-para-aperfeicoar-regras-dos-servicos-de-distribuicao-em-consequencia-da-abertura-do-mercado-para-consumidores-do-grupo-a/ Public Consultation 7/2025]. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.</p>		<p class="p1" style="text-align: justify;">Brazilian data portability rests on distinct instruments. The [https://www.planalto.gov.br/ccivil_03/constituicao/constituicaocompilado.html Constitution, article 5(LXXIX)], protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as [https://www.bcb.gov.br/content/config/Documents/Open_Banking_CMN_BCB_Joint_Resolution_1_2020.pdf amended by 4/2022;] insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under [https://www.gov.br/aneel/pt-br/assuntos/noticias/2025-defeso-eleitoral/aprovada-consulta-para-aperfeicoar-regras-dos-servicos-de-distribuicao-em-consequencia-da-abertura-do-mercado-para-consumidores-do-grupo-a/ Public Consultation 7/2025]. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.</p>
	~~<h3 class~~=~~"p1 mwt-heading" style~~=~~"text-align: justify;" >~~Assessment and Policy Priorities~~</h3>~~		=== Assessment and Policy Priorities ===
	<p class="p1" style="text-align: justify;">From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the [https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1 ANPD still listed] regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.</p>		<p class="p1" style="text-align: justify;">From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the [https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1 ANPD still listed] regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.</p><p class="p1" style="text-align: justify;">For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. [https://www.bis.org/publications/paper-168-opening-doors-open-finance-evidence-international-experience Research] identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. [https://www.cgap.org/blog/success-in-open-finance-requires-trust-lessons-brazil Survey findings ]associate lower income with lower reported adoption, without establishing national causal effects. [https://doi.org/10.1016/j.jfineco.2022.12.003 Economic theory] additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. [//doi.org/10.1108/IJOEM-07-2025-1439 Technical standardisation] therefore requires public oversight, not merely industry agreement. </p><p class="p1" style="text-align: justify;">Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established.</p>
	<p class="p1" style="text-align: justify;">For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. [https://www.bis.org/publications/paper-168-opening-doors-open-finance-evidence-international-experience Research] identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. [https://www.cgap.org/blog/success-in-open-finance-requires-trust-lessons-brazil Survey findings ]associate lower income with lower reported adoption, without establishing national causal effects. [https://doi.org/10.1016/j.jfineco.2022.12.003 Economic theory] additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. [//doi.org/10.1108/IJOEM-07-2025-1439 Technical standardisation] therefore requires public oversight, not merely industry agreement. </p>
	<p class="p1" style="text-align: justify;">Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established</p>

Paul Stein: /* Structure and Effectiveness of Brazilian Data Portability Regulation */

2026-10-08T14:38:40Z

Structure and Effectiveness of Brazilian Data Portability Regulation

← Older revision		Revision as of 16:38, 8 October 2026
Line 28:		Line 28:

	== Structure and Effectiveness of Brazilian Data Portability Regulation ==		== Structure and Effectiveness of Brazilian Data Portability Regulation ==
			<h3 class="p1 mwt-heading" style="text-align: justify;" >Legal Framework and Sectoral Regimes</h3>
	<p class="p1" style="text-align: justify;">Brazilian data portability rests on distinct instruments. The [https://www.planalto.gov.br/ccivil_03/constituicao/constituicaocompilado.html Constitution, article 5(LXXIX)], protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as [https://www.bcb.gov.br/content/config/Documents/Open_Banking_CMN_BCB_Joint_Resolution_1_2020.pdf amended by 4/2022;] insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under [https://www.gov.br/aneel/pt-br/assuntos/noticias/2025-defeso-eleitoral/aprovada-consulta-para-aperfeicoar-regras-dos-servicos-de-distribuicao-em-consequencia-da-abertura-do-mercado-para-consumidores-do-grupo-a/ Public Consultation 7/2025]. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.</p>		<p class="p1" style="text-align: justify;">Brazilian data portability rests on distinct instruments. The [https://www.planalto.gov.br/ccivil_03/constituicao/constituicaocompilado.html Constitution, article 5(LXXIX)], protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as [https://www.bcb.gov.br/content/config/Documents/Open_Banking_CMN_BCB_Joint_Resolution_1_2020.pdf amended by 4/2022;] insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under [https://www.gov.br/aneel/pt-br/assuntos/noticias/2025-defeso-eleitoral/aprovada-consulta-para-aperfeicoar-regras-dos-servicos-de-distribuicao-em-consequencia-da-abertura-do-mercado-para-consumidores-do-grupo-a/ Public Consultation 7/2025]. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.</p>
			<h3 class="p1 mwt-heading" style="text-align: justify;" >Assessment and Policy Priorities</h3>
	<p class="p1" style="text-align: justify;">From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the [https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1 ANPD still listed] regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.</p>		<p class="p1" style="text-align: justify;">From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the [https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1 ANPD still listed] regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.</p>
	<p class="p1" style="text-align: justify;">For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. [https://www.bis.org/publications/paper-168-opening-doors-open-finance-evidence-international-experience Research] identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. [https://www.cgap.org/blog/success-in-open-finance-requires-trust-lessons-brazil Survey findings ]associate lower income with lower reported adoption, without establishing national causal effects. [https://doi.org/10.1016/j.jfineco.2022.12.003 Economic theory] additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. [//doi.org/10.1108/IJOEM-07-2025-1439 Technical standardisation] therefore requires public oversight, not merely industry agreement. </p>		<p class="p1" style="text-align: justify;">For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. [https://www.bis.org/publications/paper-168-opening-doors-open-finance-evidence-international-experience Research] identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. [https://www.cgap.org/blog/success-in-open-finance-requires-trust-lessons-brazil Survey findings ]associate lower income with lower reported adoption, without establishing national causal effects. [https://doi.org/10.1016/j.jfineco.2022.12.003 Economic theory] additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. [//doi.org/10.1108/IJOEM-07-2025-1439 Technical standardisation] therefore requires public oversight, not merely industry agreement. </p>
	<p class="p1" style="text-align: justify;">Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established</p>		<p class="p1" style="text-align: justify;">Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established</p>