International EU Data Transfers: impact of Schrems II to Brazil

This contribution reviews the state of the art of the European Union (EU)’s legal framework regarding international data transfers after the Schrems II decision of the Court of Justice (of the European Union) of 16 July 2020 (case C-311/18). It will focus on the impact of the Schrems legal saga on data transfers to and from Brazil, a State which, contrary to Mercosur’s and Council of Europe’s 108 Convention members Argentina and Uruguay, has never been the recipient of an adequacy decision by the European Commission, but has recently approved legislation akin to the EU’s General Data Protection Regulation. In Schrems II, the Court of Justice accepted that Standard Contractual Clauses (SSCs) may be used in the absence of an adequacy decision, but declared that companies need to assess, on a case-by-case basis, whether national law provide adequate protection under EU law, and where it doesn’t, must provide additional safeguards of suspend data transfers