Privacy & Information Security Law Blog

On May 5, 2015, the Centre for Information Policy Leadership at Hunton & Williams (“CIPL”) filed comments in English and Portuguese on Brazil’s draft law “on the processing of personal data to protect the personality and dignity of natural persons” (the “Draft Law”).

CIPL’s comments on the Draft Law focus on several key issues that are particularly important in the context of global privacy policy and practice, including alternatives to consent to legitimize data processing, the use of organizational accountability and privacy risk management to facilitate the responsible use of data in the modern information age, and how to govern and support trans-border data flows. Specifically, the issues covered in the comments include:

• the draft law’s jurisdictional scope;
• the controller/processor distinction;
• the status of anonymized data;
• principles of processing;
• purpose specifications and “compatibility” of uses;
• consent and its alternatives and exceptions;
• cross-border transfer mechanisms;
• data transferred to Brazil for processing;
• good practices;
• the time frame for effectiveness of the law; and
• the competent authority.

The comments were part of CIPL’s ongoing Brazil outreach initiative. In March, a CIPL delegation travelled to Brasilia and Rio de Janeiro to meet with Brazilian government representatives, organizations and experts to discuss global privacy law and best practice developments and other issues of mutual interest. CIPL also has planned a joint global privacy dialogue workshop in Brazil for later this year.