The role of the Brazilian Data Protection Authority in cross-border data transfers

After a turbulent legislative process, the Brazilian Data Protection Authority (ANPD) was finally created in July 2019. However, the watchdog was unusually designed as a transitory unit within the current structure of the Presidency of the Republic with no specific workforce or budget. Within two years it may be converted into a special authority, such as other Brazilian independent regulatory agencies. The peculiar framework raised concerns about the ANPD’s independence, particularly considering the requirements to ensure free cross-border dataflow.

As required by OECD standards and as set forth by relevant legislation all over the world, an autonomous and independent data protection supervisory authority, with high technical expertise, is of paramount importance for the balance between data protection and innovation, as well as to ensure legal certainty. Independence is also crucial to protect the watchdog from the government itself – an obvious potential data privacy offender.

An adequate level of protection, including existence and effective functioning of one or more independent supervisory authorities, is a legal precondition to allow the international free transfer of data worldwide. Alongside other legal alternatives enabling the international transfer of personal data such as a legally binding instrument between governments and contractual clauses subject to authorization by the supervisory authority, the European law (“GDPR”) provides for the existence of an adequacy decision to be taken by its Commission to allow cross-border dataflow without any prior specific authorization.

The GDPR also defined the requirements for the authorities’ autonomy: national authorities shall act with complete independence, and their members shall be provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks.

The new Brazilian General Data Protection Law (“LGPD”) followed a similar pattern when drafting the adequate level of protection as a mandatory requirement to free cross-border dataflow – Brazil does have other legal hypothesis of international transfer as well. However, the current question is how independent the recently created Brazilian watchdog actually is. Its institutional framework raised concerns about whether ANPD will be prone to political pressure and if there will be mechanisms to enforce the penalties imposed by the authority.

There is no doubt that the statute provides mechanisms that contribute to characterize ANPD as an independent unit a priori. First, it molds the ANPD with explicit technical and operative autonomy. Second, its directors are protected against undue influence: they are appointed on fixed terms, and discretionary dismissal is not warranted. Third, checks and balances between Executive and Legislative branches is to some extent guaranteed: the Senate must approve the President´s appointments to the ANPD’s Board of Directors. In a nutshell, the formal framework seems to be strong enough to portray it as autonomous.

However, ANPD’s real independence and effectiveness cannot be taken for granted. Provisions such as “the ANPD is granted technical autonomy and decision-making power” are not enough to ensure per se the expected independence. And as it has been noted in other countries, the lack of financial and administrative autonomy may jeopardize its functioning. In Brazil, ANPD does not have specific workforce or budget, and the president vetoed important sources of revenue such as fees for services rendered and some important penalties that would have made the agency more effective. As a result, there is legitimate doubt about the real power of the watchdog.

Only experience will show whether ANPD will be sufficiently independent to guarantee the required adequate level of protection, ensuring the cross-border free transfer of personal data on the basis of an adequacy decision. There are reasons to believe the current framework is good enough; but governmental practice may prove the very opposite. The next two years will be of utmost importance to analyze ANPD’s independence and performance.

PDF File