BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
purchase price or specific indemnification clauses for regulatory sanctions. • Transfer of assets: in the transfer of databases, it must be verified that the original purpose of the collection of personal data allows the transfer to the new controller and that it does not constitute an international transfer of personal data. For the internal transparency notices, the following applies. • Data subjects (customers, employees and others) must be notified of the change of controller (espe - cially if there is a change in the way their data will be processed). • Opt-out and consent (or authorisation): it may be necessary to notify the data subjects and allow them to exercise their rights, including opt-out if the future processing is incompatible with the original purpose. For post-closing considerations, the following should be observed. • Deletion of unnecessary data: data not neces - sary for business continuity must be deleted or anonymised. • Systems audit (legacy): legacy systems of the acquired company may be vulnerable. Technical integration must ensure that the security of per - sonal data is maintained (security by design). • Policy harmonisation: unify privacy policies of the buyer and the acquiree. 5. International Considerations 5.1 Restrictions on International Data Transfers The topic of international transfer of personal data has been under discussion in Brazil since the entry of the General Data Protection Law in 2018. Considered as “external sharing”, international transfer brings many serious challenges, such as the risk of “infinite disper - sion” of data and the difficulty of its repatriation when the processing ends or can no longer be carried out.
Recently, the ANPD issued Resolution 19, which spe - cifically addresses this issue. According to the Reso - lution, transfer is the “processing operation through which a processing agent transmits, shares or makes available access to personal data to another process - ing agent”. If the agent receiving the data is outside Brazil, the transfer is international, as established by the LGPD (Article 5, XV), which considers it as a move - ment “of personal data to a foreign country or interna - tional organization of which the country is a member”. In the LGPD, the international transfer of personal data is permitted (Article 33), but only: • to countries or international organisations that pro - vide a level of protection of personal data adequate to that provided for in this Law; • where the national authority authorises the transfer; • where the transfer is necessary for international legal co-operation between public intelligence, investigative and prosecution bodies, in accord - ance with the instruments of international law; • where the transfer is necessary for the execution of public policy or legal attribution of the public service, with prior public disclosure in accordance with Article 23, I of this Law; • where the transfer is necessary for the protection of the life or physical safety of the data subject or a third party; • where the transfer results in a commitment assumed in an international co-operation agree - ment; • where necessary to comply with items II, V and VI of Article 7 of the LGPD; • where the controller provides guarantees of com - pliance with the principles, the rights of the data subject and the data protection regime provided for in the LGPD, in the form of: (a) specific contractual clauses for a given trans - fer; (b) standard contractual clauses; (c) global corporate standards; (d) regularly issued seals, certificates and codes of conduct; and • where the data subject has provided their specific and informed consent to the transfer.
23 CHAMBERS.COM
Powered by FlippingBook