Module 2: Data
Cross-border flows of personal data
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
Brazil
1. Introduction
Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11.
Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018.
Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's Artificial Intelligence Plan, which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.
|
Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework.
2. Broader data protection landscape
We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data.
2.1 Constitutional / fundamental rights model
Brazil has a federal constitution from 1988 which enshrines the right to privacy in two ways:
Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;
Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.
In 2022, the Constitution was amended to include a specific right to data protection:
Article LXXIX: the right to protection of personal data is ensured, including in digital media.
|
2.2 The General Data Protection Law (LGPD)
The Brazilian General Data Protection Law (LGPD) entered into force in September 2020 and is Brazil’s first comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:
- Civil Code and consumer protection legislation
- Brazilian Internet Act: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.
Scope of Application
We have considered the scope of application in three ways: personal, material and territorial.
- Personal Scope
The LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).
- Material Scope
The LGDP applies to any processing operation of personal data.
- Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
- Personal data means information regarding an identified or identifiable natural persons.
- Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).
- Territorial scope
The LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that:
- the processing is carried out in Brazil
- the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
- the personal data was collected in Brazil (Article 3-4).
Processing of Personal Data
Controllers and Processors (Articles 5, 37-40, 42-43)
- A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data
- A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller
Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):
- Purpose
- Suitability
- Necessity
- Free access
- Quality of the data
- Transparency
- Security
- Prevention
- Nondiscrimination, and
- Accountability.
Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :
- With data subject’s consent
- To comply with a legal or regulatory obligation by the controller
- By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
- For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
- For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
- For the regular exercise of rights in judicial, administrative or arbitration procedures
- As necessary for the protection of life or physical safety of the data subject or a third party
- For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
- To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
- For the protection of credit.
The data processing must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.
2.3 Interaction of the Law and the Regulation
In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A regulation (in Brazil) traditionally offers additional detail or procedural information relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation).
The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR):
- establishes special requirements and guarantees for data exports;
- defines the content of SCCs;
- outlines the analysis process for specific contractual clauses and binding corporate rules;
- specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
- outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
- proposes a template for SCCs.
3. Substantive detail of cross border data flows
Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument.
Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported.
In no hierarchy, there are various mechanisms that permit international data transfers.
- transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
- when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include:
- controller’s specific contractual clauses for a given transfer;
- standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer;
- binding corporate rules (BCR); or
- seals, certificates and codes of conduct.
The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.
3.1 When are data transfers allowed?
The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33):
- The transfer is to countries or international organizations with an adequate level of protection of personal data
- There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
- Specific contractual clauses for a given transfer
- Standard contractual clauses
- Global corporate norms, or
- Regularly issued stamps, certificates and codes of conduct
- The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
- The transfer is necessary to protect the life or physical safety of the data subject or a third party
- The ANPD has provided authorization
- The transfer is subject to a commitment undertaken through international cooperation
- The transfer is necessary for the execution of a public policy or legal attribution of public service
- The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.
3.2 Adequacy decisions
We have not identified any adequacy decisions from the ANDP. We did find a blog post dated 22 September 2024 that also indicates no adequacy decisions have yet been issued.
How is the level of protection assessed for adequacy in the recipient country?
Considerations for the ANPD (DPA equivalent) when making an adequacy decision include:
- I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
- II - the nature of the data;
- III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
- IV - the adoption of security measures provided for in the regulation;
- V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
- VI - other specific circumstances relating to the transfer (Article 34).
The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:
I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; and
II - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations.
3.3 Contractual measures
Standard contractual clauses
The ANPD (DPA equivalent) has introduced a rigid model for SCCs, drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).
Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts.
CLAUSE 2. Purpose 2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.
(NOTE: fill in as much detail as possible with information relating to the international transfer) |
Broadly, the template standard contractual clauses include detail about:
- Transparency
- Data holder rights
- Additional protection of children's privacy and sensitive personal data
- Reporting security incidents within 3 business days
- Access requests (annex II IDTR).
Equivalent Standard Contractual Clauses
Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.
Global Corporate Standards (or Binding Corporate Rules)
A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).
- Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
- Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
- Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).
3.4 Transparency Requirements
All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers.
- Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets.
- Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).
These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).