Brazil Adopts Comprehensive Privacy Law

1.     Controller or processor is established in the EU, regardless of whether the processing takes place in the EU or not;

2.     the data refers to individuals located in the EU when offering goods or services to such data subjects or monitoring their behavior;

3.     carried out by a controller not established in the EU, but in a place where Member State law applies by virtue of public international law.

1.     carried out in Brazil;

2.     related to the offering or supplying of goods or services to individuals located in Brazil;

3.     the data refers to individuals located in Brazil; or

4.     data was collected in Brazil.

1. To be informed about the collection and use of their personal data*;
2. To access their personal data;
3. To correct their personal data;
4. To restrict or object to the processing of their personal data;
5. To obtain and reuse their personal data for their own purposes across different services;
6. To delete personal data processed with the consent of the data subject;
7. To be informed consequences of not giving consent; and
8. Withdraw consent.

*the right to be informed about entities the controller has shared data with is incorporated into this right whereas the LGPD separates these rights.

1. To be informed about the collection and use of their personal data;
2. To access their personal data;
3. To correct their personal data;
4. To restrict or object to the processing of their personal data;
5. To obtain and reuse their personal data for their own purposes across different services;
6. To delete personal data processed with the consent of the data subject;
7. To be informed about entities with which the controller has shared data;
8. To be informed consequences of not giving consent; and
9. Withdraw consent.

Where the lawful basis of processing is consent, the consent must come from the child’s parent.

Parental consent is required for processing children’s and teenager’s personal data.

1.     Data subject’s consent;

2.     Execute contractual obligations where the data subject is a party;

3.     Compliance with controller’s legal or regulatory obligations;

4.     Protect the vital interests of an individual;

5.     Perform a task carried out in the public interest or in the exercise of official authority vested in the controller;

6.     Fulfill the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

1.     Data subject’s consent;

2.     Compliance with controller’s legal or regulatory obligations;

3.     Execute public policies provided by law;

4.     Carry out studies by research organizations;

5.     Execute contractual obligations where the data subject is a party;

6.     Exercise rights in judicial, administrative or arbitration procedures;

7.     Protect the physical safety of an individual;

8.     Protect health in a procedure carried out by health professionals;

9.     Fulfill the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject; or

10.  Protect a credit score.

1.     The recipient is covered by an EU adequacy decision;

2.     The entities are related entities where at least one entity is located in the EEA and the entities have agreed to binding corporate rules, which have been approved by an EEA supervisory authority;

3.     The sender is based in the EEA and has executed approved standard protection clauses with the recipient;

4.     The data subject has provided valid, explicit consent after being advised of the details and risks of such transfer;

5.     The transfer is necessary to perform a service or agreement requested by the data subject.

*Please note this is only a selection of the most common, relevant cross border transfer safeguard mechanisms under the GDPR.

1.     The recipient is covered by a Brazilian adequacy decision;

2.     The recipient is subject to contractual clauses to demonstrate data protection practices comparable to the LGPD (ex. standard contractual clauses, global corporate rules, or stamps, certificates, and codes of conduct);

3.     The data subject has given specific consent, being previously informed about the international nature of the operation; or

4.     The transfer is necessary for compliance with legal or regulatory obligations, performance of a contract, or regular exercise of rights.

*Please note this is only a selection of the most common, relevant cross border transfer safeguard mechanisms under the LGPD.