Brazil: Data Protection Authority launches public consultation on regulation of international transfers of personal data

In brief

On 15 August 2023, the Brazilian Data Protection Authority (ANPD) launched a public consultation on the regulation of international transfer of personal data, which will be available for 30 days (until 14 September 2023) on the Participa Mais Brasil platform on this link.

The draft under public consultation sets forth the Resolution of the Regulation of International Transfers of Personal Data and the Standard Contractual Clauses (SCCs) template (“Draft“), establishing provisions for the international transfer of personal data according to the Brazilian General Data Protection Law (LGPD).

ANPD aims to regulate the transfer of personal data to a foreign country or to international organizations of which Brazil is a member and which provides an adequate level of data protection in accordance with the LGPD.

The vote issued by Nairane Rabelo, the Rapporteur Director of the matter, was also published along with the Draft. The Rapporteur Director, in her vote, raises important issues that prompted the regulation of the topic, as follows:

the ANPD’s alignment with its Regulatory Agenda for the 2023-2024 biennium by regulating the international transfer of personal data;
the ANPD’s concern to ensure data controllers’ and processors’ capacity to transfer personal data to foreign countries or international organizations while respecting the principles, guidelines, and foundations established in the law; and
the importance of the regulation to ensure legal security in international transfers and also to ensure that the ANPD can supervise and, when necessary, impose sanctions on processing agents.

We highlight below the main issues mentioned in the Draft:

The distinction between international data transfer and international data collection ̶ According to the Draft, international data transfer is characterized by the transfer of personal data from the exporter to the importer. On the other hand, simple international data collection is not considered international data transfer.
The definition of requirements, conditions, and minimum guarantees for the transfer.
The content of the SCCs.
The analysis process for specific contractual clauses and binding corporate rules.
The adequacy decision mechanism by which the ANPD may recognize the equivalence of the level of personal data protection of a foreign country or international entity with national personal data protection legislation.
The definition of deadlines and how to communicate the changes to the provisions set forth.

ANPD has yet to recognize the equivalence of standard contractual clauses from other countries or international organizations. In this sense, the Draft stipulates that ANPD may recognize the equivalence of standard contractual clauses through a procedure initiated ex officio or at the request of interested parties. The Draft also highlights that ANPD will prioritize the approval of clauses that can be used on a large scale by other processing agents that conduct international data transfers in similar circumstances.

If standard contractual clauses from other countries or international organizations have their equivalence recognized, they will be approved by a resolution of the Executive Board and published on the ANPD website.

The Draft also stipulates that the data controller may similarly request the approval of specific contractual clauses before the ANPD in light of the particularity of certain international data transfers. According to the Draft, binding corporate rules may also be approved by the Authority through a specific procedure and will be binding on all members of the economic group.

Moreover, the Draft contains a template of standard contractual clauses, which can be used as part of a specific contract to regulate the international transfer of data or be added to a contract with a broader object.

The Draft proposes that processing agents who carry out international data transfers by means of standard contractual clauses should incorporate the clauses approved by ANPD into their respective contractual instruments within a period of up to 180 days, counted from the date of publication of the resolution.

* * * * *