Module 2: Data

Cross-border flows of personal data

Cross-border data flows refers to the transferring of personal data between servers across different country borders.

1. Introduction 

Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. 

Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. 

Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's Artificial Intelligence Plan, which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.

Aside: What is Brazil’s AI Plan?  On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028.  The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.

Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

2. Broader data protection landscape 

We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. 

2.1 Constitutional / fundamental rights model 

Brazil has a federal constitution from 1988 which enshrines the right to privacy in two ways: 

Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;

Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.

In 2022, the Constitution was amended to include a specific right to data protection: 

Article LXXIX: the right to protection of personal data is ensured, including in digital media. 

National context for Brazil:  Brazil is a federation of 26 states. The current Constitution dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship.  Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law. Constitutional law in Brazil is a hybrid system that combines: decentralised, incidental judicial review like in the United States; with centralised, abstract judicial review like in Germany and Italy.