Brazil's Data Protection Act ('LGPD') And Arbitration

• Published date: 16 August 2021
• Subject Matter: Litigation, Mediation & Arbitration, Privacy, Data Protection, Arbitration & Dispute Resolution
• Law Firm: Fonseca E Salles Lima
• Author: Mr Rodrigo Garcia da Fonseca and Bruno Sant'Anna Fucci

Data protection and Brazil's LGPD

Data has been referred to as the 'oil of the digital era'.¹ As data progressively plays a central role in nearly all human activities and assumes unprecedented levels of both social and economic relevance, a pressing call for regulation and adequate legal protection has surged across the world. Unlike traditional commodities, data can be effortlessly collected and transferred across borders. The challenges for a harmonious coexistence of legislation from different jurisdictions are even greater than in other areas.

Over the last few years, data protection laws have been enacted all around the globe.² Their effects are only starting to be fully understood and assimilated. Brazil's recent Data Protection Act ('Lei Geral de Proteç'o de Dados', or simply 'LGPD'), came into force on 18^th September 2020, prompting businesses and professionals in general to face significant new duties and responsibilities in their usual activities. Arbitration practitioners must pay particular attention to the new legislation.

Material and territorial scope

The statute applies to any data treatment operation carried out by natural persons or legal entities (as per the definition provided for by Article 5, item X of the LGPD), thus affecting virtually all Brazilian public or private organizations. As a fact-finding proceeding with inevitable data-sharing obligations, arbitral activity triggers LGPD rules and principles pertaining to data security (see Article 6, item VII of the LGPD).

Other than data-processing operations ordinarily implemented in Brazil, the statute's territorial scope encompasses extra-jurisdictional situations in which data-processing - although not executed within the national territory - aims to supply goods or services to people located in Brazil or relates to individuals located within its territory at the time of the data collection (see Article 3 of the LGPD). Such approach is notable as it may turn not only Brazilian, but also international economic operators, into possible addressees of LGPD's provisions (and therefore this might include, i.e., foreign arbitral tribunals, as well as foreign arbitral institutions dealing with proceedings in any way related to Brazil).

Data-processing agents: controller and processor

The LGPD makes an important distinction between the roles of the data controller and of the data operator/processor, both types of 'data processing agents' under the statute. This is particularly relevant for...