In an increasingly globalized world, where the exchange of data between countries is constant and necessary for the functioning of various economic and technological activities, the General Data Protection Law (LGPD) imposes strict rules to ensure that the rights of data subjects are respected, even when this information crosses borders.
On this subject, on 23/08/2024 the National Data Protection Authority (ANPD) published Resolution CD/ANPD no. 19/2024 (“” resolution), which establishes the procedures and rules applicable to international data transfer operations.
Preliminarily, it is worth remembering that international transfer occurs when the agent, from inside or outside Brazil, transmits, shares or makes available access to personal data outside the national territory. The transmitting agent is called an exporter, while the agent that receives the data is called an importer.
The international transfer of personal data can only take place when it is supported by a legal basis provided for in the LGPD and by one of the following mechanisms: countries with adequate protection, contractual standard clauses, global corporate standards or specific contractual clauses and, finally, guarantees of protection and specific needs.
Among the mechanisms described above, the instrument of standard contractual clauses was already known in international legislative contexts (especially in Europe, under the General Data Protection Regulation). In the Brazilian context, it is also possible to foresee a wide use of this instrument in contracts.
The text of the contractual standard clauses is contained in the same Regulation, in Annex II, which provides for a set of 24 clauses formulated by the ANPD, to be incorporated into contracts involving the international transfer of data, to ensure that exporting agents and importers of personal data maintain an adequate level of protection, equivalent to that required by Brazilian law. Companies have a period of 12 months, from publication, to adjust their contracts.
However, the use of standard clauses brings a number of impacts to agents' contracts. Among such main impacts, we highlight:
Changes to the terms of the contract: in addition to the fact that the text of the standard clauses cannot be changed, the Resolution also determines that the original text of the contract must not contradict the provisions of the standard clauses. In this way, the agent must review and, if necessary, change the provisions of the contracts to ensure the compliance of the international transfer.
Distribution of responsibilities: the clauses clearly define the responsibilities of the parties involved in the processing and protection of personal data, assigning specific duties to both controllers and operators. Such responsibilities are divided between proof of adoption of effective measures, transparency duties, compliance with the rights of the holders, communication of security incidents, compensation for damages and adequacy to various treatment modalities.
Transparency: The controller must provide the holder, if requested, with the full contractual clauses used, observing the commercial and industrial secrets, as well as publish on its website, on a specific page or integrated into the Privacy Policy, clear and accessible information on the international transfer of data.
Penalty risk: failure to comply with standard clauses can result in severe penalties, including fines, and damage the reputation of the companies involved.
Definition of jurisdiction and jurisdiction: any disagreement with the terms of the standard clauses shall be resolved before the competent courts in Brazil.
Because of such impacts, renegotiation of contracts between agents will be necessary in many cases to include standard clauses. More precisely, the ANPD standard clauses for international transfers of personal data impose a new layer of complexity to business contracts, requiring detailed revisions, adaptations in clauses and a greater formality in business relations. However, by standardizing practices and ensuring legal certainty, these clauses contribute to the creation of a safer and more reliable environment for the circulation of data beyond national borders, essential in an increasingly interconnected world.
