The Brazilian Data Protection Authority (ANPD) has taken further steps towards fulfilling its regulatory agenda. On August 15 and 16, 2023, ANPD announced the opening of two new public consultations: one to regulate the international transfer of personal data (article 33 of LGPD) and another to subsidize the content of the future guideline for data processing based on the legitimate interests of the controller and third parties (art. 7, IX of LGPD).
International Transfer of Personal Data
The Public Consultation about a Regulation on the International Transfer of Personal Data and its sample contractual standard clauses brings a proposal for a draft Resolution with the purpose of disciplining the transfer of personal data to foreign countries or to international organizations of which Brazil is a member.
This demand stems from the provisions of articles 33 to 36 of LGPD, which provide for the adoption of criteria by the Regulatory Authority for these transfers to occur in an appropriate manner. The regulation of this topic was already foreseen in ANPD’s Regulatory Agenda for the 2023/2024 Biennium, under Phase 1 – which comprises the topics foreseen in the previous agendas which had not been addressed in that period.
The draft proposes specific guidelines and minimum guarantees for international transfer, definitions of new and relevant terms, in addition to providing models of Standard Contractual Clauses and a deadline for adequacy. It also provides for the adoption of the Adequacy Decision mechanism by ANPD, which will allow recognition, by the Regulatory Authority, of equivalence in the level of protection of personal data of a foreign country or international organization with the Brazilian legislation.
In addition, the Resolution brings, among others, the possibility of recognition and/or approval by ANPD of (i) Equivalent Standard Contractual Clauses – originating from another country or international body; (ii) Specific Contractual Clauses – in order to tailor international transfers of data that cannot be carried out on the basis of contractual standard clauses; and (iii) Global Corporate Rules – intended for international data transfers among organizations of the same economic group, through a specific administrative process.
The Public Consultation on the Regulation on the International Transfer of Personal Data was published on August 15, 2023 and will be open to contributions by society for one month – until September 14, 2023. Contributions must be submitted through the Participa + Brasil platform. At the time of preparation of this notice, ANPD had already received thirty-six contributions.
Processing of Personal Data for Legitimate Interest
LGPD provides for several hypotheses that authorize the processing of personal data, the so-called "legal grounds". One of these legal grounds is provided for in article 7, IX: to meet the legitimate interest of the controller or of a third party.
Since the entry into force of the Law, this legal ground has led to several discussions about its application and what would be considered “legitimate interest”. In this sense, the aforementioned Public Consultation for a Preliminary Study on legitimate interest was opened, in order to unite the technical expertise of the Authority with the practical experience of processing agents on the subject, in order to subsidize future guidelines that clarify doubts and synthesize the Regulatory Authoritys understanding.
The regulation of this topic was also foreseen before in ANPD’s Regulatory Agenda for the 2023/2024 Biennium, under Phase 1 – which comprises the topics listed in the previous agendas that were not addressed in that period.
The Study is divided into three parts: (i) definitions and parameters of interpretation – identification of the nature of personal data, whether the personal data are sensitive, whether they are personal data of children and/or adolescents, whether the data will be used; (ii) considerations on legitimate interest – identification of the interest that justifies the processing and the evaluation of its legitimacy (including as to its purpose), compliance with the principles of necessity and transparency, whether the fundamental rights and freedoms of the subjects will be safeguarded, whether the processing respects the legitimate expectations of the subject, in addition to the requirement to record the processing operations when based on legitimate interest; and (iii) balancing test – assessment of proportionality based on the context and specific circumstances of the data processing, taking into account the impacts and risks to the rights and freedoms of the data subjects.
The balancing test should be applied for each specific purpose, and involves carrying out a weighing that considers the legitimacy of the interest, the need for the processing, the impacts on the rights of the subjects and their legitimate expectations compared to the interests involved. The test has three steps: (i) purpose: analysis of the context of the processing, focusing on the benefits generated and the intended purposes; (ii) necessity: to identify whether the processing based on the legitimate interest is necessary to achieve the objectives of the previous step, in addition to establishing measures to minimize the use of data to achieve the intended purpose; (iii) balancing and safeguards: balancing between, on one hand, the interests of the controller or of a third party and, on the other, the fundamental rights and freedoms of the subject, in addition to balancing these risks with the safeguards to be adopted to mitigate any risks.
ANPD also highlights that the guidelines presented in the Study, including the balancing test, also apply to the legal grounds of processing sensitive personal data to ensure fraud prevention and the safety of the subject (art. 11, II, g of LGPD). This is because there is a systematic similarity of this hypothesis with that of legitimate interest, since both condition the processing of personal data to the prevalence of the fundamental rights and freedoms of the subjects.
In addition, the Study reinforces the need for processing agents to keep a record of the activity and documentation related to the balancing test (in order to comply with the principle of accountability) and to observe the need to prepare a report about the impact for protection of personal data, under the terms required by LGPD.
The Study also includes attachments with a legitimate interest step-by-step assessment and with a simplified testing model. The model proposed by ANPD, however, is not binding and should not be mandatorily used on all situations. It is necessary that each organization make an assessment suitable for its organizational reality, resources and peculiarities of the processing activity developed.
The Public Consultation on the Preliminary Study on Legitimate Interest was published on August 16, 2023 and will be open to contributions by society for one month, i.e., until September 15, 2023. Contributions must be submitted through the Participa + Brasil platform. At the time of preparation of this notice, ANPD had received one contribution to this Consultation.
Next steps
According to the Authority’s disclosure in its previous Regulatory Agenda (referring to the 2021/2022 biennium), the instrument for the regulation on International Transfer would take place through the elaboration of a Resolution by its Board of Directors, which can be noted in the current Public Consultation. Regarding the legal grounds of processing, including legitimate interest, the regulation would take place through the publication of a Good Practices Guide, which is expected to be published by ANPD at the end of the current Public Consultation.
This dynamic has been applied since the creation of the Regulatory Authority. This was the case with dosimetry and application of sanctions, which also underwent public consultation and resulted in the publication of Resolution CD/ANPD 4/2023, containing the Regulation on Dosimetry and Application of Administrative Sanctions. Similarly, for the grounds of processing personal data for academic purposes and for conducting studies and research, a Technical Study was published for discussion with society, followed by the publication of a Guideline with parameters for the relevant institutions.
The Technology, Media and Telecommunications team at Azevedo Sette Advogados follows up on the development of the above matter and is available for answering questions and providing contributions.