EU puts Brazil on path to mutual adequacy status
On 4 September, the European Commission launched the process towards the adoption of a data protection adequacy decision with Brazil declaring that it ensures an adequate level of data protection on a similar basis to that of the EU. Once adopted, this will be the first EU GDPR adequacy decision for Latin America since Argentina on 3 June 2003 and Uruguay on 21 August 2012.
The adopted decision would allow for free and safe data flows for businesses, public authorities, and research projects between the EU and Brazil under the EU GDPR. The Brazilian authorities have also initiated a process to adopt an equivalent decision to allow for Brazilian data to flow freely to the EU. The result will be to the benefit of the combined 670 million consumers.
The next steps will be for the draft decision to be reviewed by the European Data Protection Board and the Council of Ministers representing the EU Member States. The European Parliament also has a right to scrutinise this draft adequacy decision.
The 52 page 238 paragraph draft adequacy document includes:
- Brazil’s constitutional framework and its data protection framework
- The material and territorial scope of Brazil’s data protection law, the LGPD
- Safeguards, rights and obligations
- Oversight and enforcement, including redress for data subjects by means of judicial and administrative mechanisms to effectively enforce their rights including compensation for damages
- Access and use of personal data transferred from the EU by public authorities in Brazil.
Once in place, the functioning of the adequacy decision will be subject to periodic reviews carried out by the European Commission, together with European Data Protection Authorities.
Michael McGrath, European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, said: “Brazil has built a robust framework for safeguarding privacy and personal data, firmly anchored in the protection of fundamental rights. Strengthening partnerships with countries that uphold the highest standards of data protection is both natural and essential. Mutual adequacy decisions represent a vital step in that direction. When personal data is protected, so too are consumer rights—ensuring individuals have control, transparency, and security in their interactions with businesses and services.”