Brazilian Data Protection Authority launches public consultation on regulation of international transfers of personal data

In brief

On August 15, 2023 (Tuesday), the Brazilian Data Protection Authority (ANPD) launched a public consultation on the regulation of international transfer of personal data, which will be available for 30 days on the Participa Mais Brasil platform, on this link (between August 15 and September 14).

In more detail

The draft under public consultation sets forth the Resolution of the Regulation of International Transfers of Personal Data and the Standard Contractual Clauses (SCCs) template (“Draft”), establishing provisions for the international transfer of personal data, according to the Brazilian General Data Protection Law (LGPD).

ANPD aims at regulating the transfer of personal data to a foreign country or to international organizations of which Brazil is a member and which provide an adequate level of data protection in accordance with the LGPD.

The vote issued by Nairane Rabelo, the Rapporteur Director of the matter, was also published along with the Draft. According to her vote, the Rapporteur Director raises important issues that motivated the regulation of the topic, as follows: (i) the ANPD’s alignment with its Regulatory Agenda for the 2023-2024 biennium by regulating the international transfer of personal data; (ii) the Authority’s concern to ensure data controllers and processors capacity to transfer personal data to foreign countries or international organizations while respecting the principles, guidelines and foundations established in the Law; and (iii) the importance of the regulation to ensure legal security in international transfers and also to ensure that the ANPD can supervise, and, when necessary, impose sanctions on processing agents.

We highlight below the main issues mentioned in the Draft:

• The distinction between international data transfer and international data collection. According to the Draft, the international data transfer will be characterized when the exporter transfers personal data to the importer. On the other hand, the simple international data collection will not be considered an international data transfer;
• The definition of requirements, conditions and minimum guarantees for the transfer;
• The content of the SCCs;
• The analysis process for specific contractual clauses and binding corporate rules;
• The adequacy decision mechanism, by which the ANPD may recognize the equivalence of the level of personal data protection of a foreign country or international entity with national personal data protection legislation; and
• The definition of deadlines and how to communicate the changes to the provisions set forth.

ANPD has not yet recognized the equivalence of standard contractual clauses from other countries or international organizations. In this sense, the Draft stipulates that ANPD may recognize the equivalence of standard contractual clauses through a procedure initiated ex officio or at the request of interested parties. The Draft also highlights that ANPD will prioritize the approval of clauses that can be used on a large scale by other processing agents that conduct international data transfers in similar circumstances.

If standard contractual clauses from other countries or international organizations have their equivalence recognized, they will be approved by a Resolution of the Executive Board and published on the ANPD website.

Additionally, the Draft also stipulates that the data controller may similarly request the approval of specific contractual clauses before the ANPD, in light of the particularity of certain international data transfers. According to the Draft, binding corporate rules may also be approved by the Authority by a specific procedure and will be binding on all members of the economic group.

Moreover, the Draft contains a template of standard contractual clauses, which  can be used as part of a specific contract to regulate the international transfer of data or can be added to a contract with a broader object.

The Draft proposes that processing agents who carry out international data transfers by means of standard contractual clauses should incorporate the clauses approved by ANPD into their respective contractual instruments within a period of up to one hundred and eighty (180) days, counted from the date of publication of the resolution.