BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
In the above-mentioned Resolution 19, the ANPD also established which standard clauses must be adopted by controllers if the international transfer of personal data can use this mechanism. Fortunately, with regard to the European Union, the EU and Brazil already recognise that both personal data protection systems (GDPR and LGPD) are equiva - lent, which facilitates international transfers based on “essential equivalence” (LGPD, Article 33, I). 5.2 Government Notifications and Approvals For the international transfer of personal data, some protocols and conditions must be met, especially after ANPD Resolution 19. An international transfer of personal data can only occur under one of the “specific regulatory conditions” established by the LGPD (Article 33). In practice, each of these “regulatory conditions” is an “additional legal basis” (in addition to those provided for in Articles 7 and 11 of the LGPD) for the transfer, a kind of double layer of protection. This allows the data subject to be sure that their data will only be shared with another nation under the legal guarantee of “formal and material ade - quacy”, the so-called principle of double command. In international transfers of personal data, some guar - antees are required, such as: • although regulatory approval is not required for each transfer, the use of at least one of the mecha - nisms provided for in Article 33 of the LGPD is mandatory; • express purpose and well-established legal basis; • data mapping, security assessment, and imple - mentation of safeguards; • it may also be necessary to base the transfer on Binding Corporate Rules (BRCs) if the transfer takes place within the same economic group, provided that they are approved by the competent data protection authority; and • an impact assessment (TIA) may be required – the national controller must assess whether the legisla - tion of the destination country compromises data protections.
For international transfers of non-personal data (any data not directly related to the privacy of individuals) certain safeguards are also required, including: • express purpose and transparent purpose; • some European and US standards (such as ITAR or EAR) require approval to transfer technical data, software, or technology to “unauthorised persons” or embargoed countries; • formal request to government agencies; • compliance with bilateral or multilateral treaties; • identification of a compliance officer; • knowing precisely what data is going out and who will receive it; • contracts with standard clauses or evidence of encryption; and • legal assessment, ie, making sure that the transfer does not violate security or privacy laws. 5.3 Data Localisation Requirements Neither the LGPD nor the Brazilian data regulator clearly imposes a restriction on the location of per - sonal data, which means that, by definition, the data does not need to be stored exclusively in Brazil, or even physically located in Brazil. In practice, the data must be “locatable”, but not necessarily “localised”, that is, processing agents must know where the data can be found, but this does not necessarily imply that it must be stored in a specific country or confined to a specific storage location. However, some sectors, such as finance, have more explicit rules on the location of personal data. The Central Bank, for example, as a regulator, requires that financial institutions that use cloud services hosted abroad must ensure full and immediate access to data by the Brazilian regulator. If the cloud is in a country without a co-operation agreement with the Central Bank, the contracting requires prior authori - sation from this regulator (CMN Resolution 4,893/21, Articles 11 and 12). The health sector is another that sets limitations on the international transfer of data related to clinical research, the development of medi - cal resources and pharmacology. In particular, raw, sensitive and restricted data must be kept locally or transferred under confidentiality rules.
24 CHAMBERS.COM
Powered by FlippingBook