International personal data transfer: An analysis of Brazil’s legal system and new LGPD under the adequacy standard of the EU GDPR

Abstract

The international transfer of personal data is an issue of fundamental importance in data protection. The General Data Protection Regulation (GDPR) has conditioned all data flow to third countries to stringent alternative requirements, the most important of which being the existence of an adequacy decision made by the European Commission finding the level of data protection afforded by that third country to be equivalent to the one provided by the GDPR. This study aims to apply the adequacy standard, as established by the GDPR and interpreted by the Court of Justice of the European Union (CJEU), the Article 29 Working Party and the European Commission, in order to determine whether Brazil has the potential of obtaining a favourable decision from the European Commission. The country’s legal system and new Lei Geral de Proteção de Dados Pessoais (LGPD) were analysed, in depth, with a focus on the three elements the GDPR requires to be taken into account in the course of adequacy findings: a legal framework containing certain core elements, an independent supervisory authority and the international commitments of the country. The results indicate that Brazil’s legal system offers appropriate tools capable of providing data subjects with an adequate level of protection, which, subject to future regulation on the time limits for compliance with certain privacy rights, can be considered equivalent to the level of protection guaranteed by the GDPR. Such a finding, should it be confirmed by the European Commission in the future, would have the effect of allowing the transfer of personal data from Europe to Brazil.