BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
ler obtain a “periodic statement” from the cloud provider about the location of the data stored in it. 5.4 Blocking Statutes Blocking statutes, also known as “block rules”, in the context of privacy and personal data, can refer either to rules and practices that allow the restriction of access to, and use of, personal data in certain situations and under certain con - ditions, in order to ensure the protection of the privacy of individuals, or to a law in one jurisdic - tion intended to prevent the application in that jurisdiction of a law of another jurisdiction. In general, blocking statutes involve the follow - ing aspects. • Conditions – request from the holder, in cases of contestation or doubt about the accuracy of the data. • Inadequacy or excessiveness – for data that is no longer in accordance with the purposes for which it was collected. • Compliance – to meet legal or regulatory requirements. • Rights of the holders. • Right to block – to request that your data be blocked in some situations. • Right to information – data subjects must be informed about the status of their data and the reasons for the blocking. • Impact on availability – locked data cannot be used for processing, which can affect ser - vices and products. • Data review – blocking can be temporary (while investigating the legality of the pro - cessing or the accuracy of the data). • Procedure for blocking – data subjects must follow specific procedures to request block - ing, usually through the channels of the com - panies that process the data.
• Security – entities implementing blocking statutes must ensure that data is stored securely and that access to it is restricted. • Controllers must regularly monitor and audit their blocking practices to ensure compliance and protection of personal data. Within the scope of the LGPD, blocks can be applied in two ways, in short: • at the request of the data subject, as a specific right of their condition (Article 18, IV, LGPD), and • as a penalty to the controller (Article 52, V, LGPD). In any case, there are situations in which the blocking may not be applicable (data necessary for compliance with legal obligations or for the defence of rights in legal proceedings) (LGPD, Article 7, II and VI). 5.5 Recent Developments In addition to the recent rule approved by the ANPD (Resolution CD/ANPD 19/2, or Interna - tional Data Transfer Regulation), some con - cepts and guidelines have gained space in Brazil regarding the international transfer of personal data. One of these developments is the clarification of what “adequate level of protection” means: for the ANPD this means equivalence in the level of protection of personal data, that is, the regulator will seek a protection structure similar, or reason - ably comparable, although not necessarily iden - tical to the one existing in the Brazilian territory. Another welcome novelty is that the regulator has assumed the practice of reciprocity, which means that, in terms of international data trans- fer, it will prioritise countries that offer reciprocal
52
CHAMBERS.COM
Powered by FlippingBook