EDPB Issues Opinion on EU-Brazil Data Protection Adequacy Decision
The European Data Protection Board (EDPB) has issued its opinion on the European Commission’s draft adequacy decision regarding Brazil’s data protection framework. This decision, once finalized, would allow the free flow of personal data from the European Union (EU) to Brazil while ensuring that the fundamental rights of individuals are respected and protected.
The EDPB acknowledged the significant alignment between Brazil’s data protection laws and the EU’s General Data Protection Regulation (GDPR), including relevant rulings from the Court of Justice of the EU. However, the Board requested clarifications on specific issues such as the application of Data Protection Impact Assessments (DPIAs), limitations on transparency related to commercial and industrial secrecy, and the rules governing onward transfers of personal data.
Brazilian data protection law generally does not cover data processed by public authorities for purposes like public safety, national defense, state security, or criminal investigations. Nevertheless, the EDPB welcomed the interpretation by Brazil’s Federal Supreme Court that the law partially applies to data processing in criminal investigations and public order maintenance. This nuance is important for ensuring adequate protection of personal data in sensitive contexts.
The Board also urged the European Commission to clarify the scope of Brazil’s data protection law in relation to law enforcement activities and to define the investigatory and corrective powers of Brazil’s Data Protection Authority in these areas. Additionally, it requested further detail on Brazil’s definition of national security to ensure transparency and compliance with EU standards.
