Applicability of Data Protection Law in Brazil Based on Physical Location of Data Subject

The factor of a data subject's physical location or residency is crucial in determining the scope of data protection laws in Brazil. This factor specifies that data protection laws apply to data collected from individuals who are physically present in Brazil at the time of data collection.

Text of Relevant Provisions

Referenced Provision(s):

"This Law applies to any processing operation carried out by a natural person or a legal entity of either public or private law, irrespective of the means, the country in which its headquarter is located or the country where the data are located, provided that: I – the processing operation is carried out in the national territory; II – the processing activity is aimed at the offering or provision of goods or services, or at the processing of data of individuals located on the national territory; or III – the personal data being processed were collected in the national territory. §1 Data collected in the national territory are considered to be those whose data subject is in the national territory at the time of collection."

Original (Portuguese):

"Esta Lei se aplica a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica de direito público ou privado, independentemente dos meios, do país onde esteja localizada a sede ou do país onde estejam localizados os dados, desde que: I – a operação de tratamento seja realizada em território nacional; II – a atividade de tratamento tenha por objetivo a oferta ou prestação de bens ou serviços, ou o tratamento de dados de indivíduos localizados em território nacional; ou III – os dados pessoais objeto do tratamento tenham sido coletados em território nacional. §1 Os dados coletados em território nacional são considerados aqueles cujos titulares dos dados estejam em território nacional no momento da coleta."

Analysis of Provisions

The provisions from Article 3 of the General Personal Data Protection Law (LGPD) indicate that the law applies to data processing based on specific conditions:

1. Article 3(III) and §1 specify that the LGPD applies when personal data is collected in Brazil. Specifically, "the personal data being processed were collected in the national territory" (Article 3(III)) and "data collected in the national territory are considered to be those whose data subject is in the national territory at the time of collection" (§1) directly link the applicability of the law to the physical location of the data subject at the time of data collection.
   • This requirement establishes that the data protection obligations of the LGPD extend to personal data collected from individuals present in Brazil at the time of collection, regardless of where the data processing occurs or where the data controller or processor is located.
2. The purpose of this factor is to ensure that the LGPD provides protection to individuals whose personal data is collected within Brazil. It emphasizes the territorial aspect of data collection, ensuring that the protection is in place for individuals who are physically in Brazil when their data is collected.
3. The language in Article 3(III) and §1 clarifies that data collected in Brazil is subject to the LGPD if the data subject is present in Brazil at the time of collection. This focus on the physical presence of the data subject at the time of collection aims to align the scope of the law with the actual location of the data subjects, ensuring their protection under Brazilian law.

Implications

For businesses operating in Brazil or dealing with Brazilian data subjects, this provision means that:

• Scope of Applicability: Data processing activities involving personal data collected from individuals physically present in Brazil must comply with the LGPD, regardless of where the data processing occurs or where the business is headquartered.
• Operational Impact: Companies must implement mechanisms to ensure compliance with the LGPD's requirements when collecting data from individuals in Brazil. This includes providing appropriate notices and obtaining consent where necessary, in line with Brazilian data protection standards.
• Data Controllers and Processors: Both data controllers and processors must be aware of these requirements and ensure that their data handling practices adhere to Brazilian data protection laws when dealing with data collected from Brazilian data subjects.

Understanding this factor is essential for ensuring that data protection practices align with the requirements set forth by Brazilian legislation.