Memorandum of Understanding (Brazilian National Data Protection Authority)

MEMORANDUM OF UNDERSTANDING
BETWEEN
THE BRAZILIAN NATIONAL DATA PROTECTION AUTHORITY (ANPD)
AND
THE PRIVACY COMMISSIONER OF CANADA (PCC)
ON
MUTUAL ASSISTANCE IN THE ENFORCEMENT OF LAWS PROTECTING PRIVACY AND PERSONAL DATA

---

This Memorandum of Understanding (the “MOU”) is entered into today, the 1st day of November the year of 2024 by and between:

The BRAZILIAN NATIONAL DATA PROTECTION AUTHORITY, hereinafter referred to as ANPD, established by Provisional Presidential Decree n. 869, of December 27th, 2018, subsequently converted into Law n. 13,853, of August 14th, 2019, and transformed into a government agency operating under a special regime by Law n. 14,460, of October 25th, 2022, registered before the National Register of Corporate Taxpayers – CNPJ, under number 44.365.866/0001-71, located at Setor Comercial Norte – SCN, Quadra 6, Conjunto A, Ed. Venâncio 3000, Bloco A, 9º andar, CEP 70.716-900 – Brasília – DF, Brazil, herein represented by its Director-President, Mr. WALDEMAR GONÇALVES ORTUNHO JÚNIOR,

and THE PRIVACY COMMISSIONER OF CANADA, Mr. PHILIPPE DUFRESNE, hereinafter referred to as the PCC, established under the Privacy Act, R.S.C. 1985, c. P-21, located at 30 Victoria Street, Gatineau, Quebec, K1A 1H3, Canada.

The ANPD and PCC shall hereinafter be referred to individually as “Participant”, or collectively as “Participants”,

RECOGNIZING the nature of the modern global economy, the increase in circulation and exchange of personal data and information across borders, the increasing complexity of information technologies, and the resulting need for increased cross-border enforcement cooperation on protection of personal data and information;

RECOGNIZING that Article 55-J, item IX, of Law n. 13,709 of August 14, 2018 – Brazilian Data Protection Law (LGPD) confers upon the Brazilian National Data Protection Authority (ANPD) powers to promote international or transnational cooperation actions with personal data protection authorities of other countries;

RECOGNIZING that s. 23.1 of the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”) authorizes the Privacy Commissioner of Canada (PCC) to share information with authorities from other countries that have responsibilities relating to the protection of personal data and information;

RECOGNIZING that the Participants each have functions and duties with respect to the protection of personal data and information in their respective countries;

RECOGNIZING that the Participants are interested in working together on various matters related to the protection of personal data and information;

HAVE AGREED to cooperate under this Memorandum of Understanding (Memorandum) as follows:

Clause one - Definitions

1.1. For the purposes of this Memorandum, the following terms and acronyms, when used in the singular or plural, shall have the meaning indicated below, unless the context otherwise requires.

1. “Applicable Law” refers to the laws and regulations of the country of each Participant, the enforcement of which has the effect of protecting personal data and information. This includes any amendments to the privacy and personal data protection laws of both jurisdictions, as well as other laws or regulations that the Participants may, from time to time, jointly decide in writing to be an Applicable Law for the purposes of this Memorandum.
   
   

   a.1) In the case of the OPC, “Applicable Law” means Part 1 of the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA)

   a.2) In the case of the ANPD, “Applicable Law” means Law n. 13,709 of August 14, 2018 – Brazilian Data Protection Law (LGPD).

2. “Covered Privacy Contravention”, as provided for in this Memorandum, means conduct that would be in contravention of the Applicable Laws of one Participant’s country and that is the same or substantially similar to conduct that would be in contravention of the Applicable Laws of the other Participant’s country.
3. “Person” means any natural person or legal entity, including any corporation, unincorporated association, or partnership.
4. “Request” means a written request for assistance under this Memorandum.
5. “Requested Participant” means the Participant from which assistance is sought under this Memorandum, or which has provided such assistance.
6. “Requesting Participant” means the Participant seeking or receiving assistance under this Memorandum.

Clause two – Objectives and scope

2.1. By means of this Memorandum of Understanding, the Participants shall make the necessary efforts to promote mutual assistance and technical, regulatory and enforcement cooperation on matters related to privacy and the protection of personal data and information.

2.2. The Participants acknowledge that it is in their common interest to collaborate in accordance with this Memorandum, in order to:

1. ensure that the Participants are able to deliver the regulatory cooperation necessary to protect the fundamental privacy rights of citizens of Brazil and Canada respectively, in accordance with the Applicable Laws of the Participants’ respective jurisdictions;
2. cooperate with respect to the enforcement of their respective Applicable Laws;
3. keep each other informed of developments of Applicable Laws in their respective countries having a bearing on this Memorandum of Understanding;
4. provide technical support and share experiences relating to regulation and enforcement in respect of protection of personal data and information;
5. provide information about concomitant investigations, upon request;
6. promote joint investigation or enforcement actions of mutual interest in respect of the protection of personal data and information;
7. support the other Participant in its jurisdiction for the purposes of investigation or enforcement, based on the respective Applicable Laws.

2.3. For the purposes of this Memorandum of Understanding, the Participants may jointly identify one or more areas or initiatives for cooperation, such as:

1. sharing of experiences and exchange of best practices on privacy and data protection policies;
2. developing education, training and awareness-raising programs on personal data protection;
3. implementing and carrying out joint research projects;
4. exchanging information (excluding personal data or information) involving potential or on-going investigations in relation to a Covered Privacy Contravention;
5. carrying out joint investigations on cross-border issues involving both jurisdictions under Applicable Laws (excluding sharing of personal data or information); or
6. convening bilateral meetings as mutually decided between the Participants.

2.4. This Memorandum does not impose on either Participant any obligation to cooperate with each other or to share any information.

2.5. Where a Participant chooses to exercise its discretion to cooperate or to share information, it may limit or impose conditions on that request, whether

1. it is outside the scope of this Memorandum; or
2. it would breach the Participant’s legal responsibilities.

Clause three – Procedures relating to mutual assistance

3.1. Each Participant shall designate a point of contact for the purposes of requests for assistance and other communications under this Memorandum of Understanding.

3.2. In requesting assistance in procedural, investigative and other matters involved in the enforcement of Applicable Laws across borders, Participants will ensure that requests for assistance include sufficient information to enable the Requested Participant to determine whether a request relates to a Covered Privacy Contravention and to take action in appropriate circumstances.

3.3. Requests shall include the motivation and a description of the facts underlying them and the type of assistance sought, as well as an indication of any special precautions that should be taken in the course of fulfilling the request.

3.4. Requests for assistance shall specify the purpose for which the information requested will be used.

3.5. Prior to requesting assistance, Participants shall perform a preliminary inquiry to ensure that the request is consistent with the scope of this Memorandum and does not impose an excessive burden on the Requested Participant.

3.6. Participants shall make efforts to communicate and cooperate with each other, as appropriate and under the terms of this Memorandum, on matters that may assist ongoing investigations.

3.7. The Participants will notify each other without delay, if they become aware that information shared under this Memorandum is not accurate, complete or up-to-date.

3.8. Participants may, forward requests for investigations, refer complaints or provide notices regarding possible violations of Applicable Laws in the jurisdiction of the other Participant.

Clause four – Points of contact

4.1. The following designated persons shall act as points of contact for the Participants for matters under this Memorandum and the joint activities resulting from it.

4.1.1. For ANPD:

Name: Eduardo Gomes Salgado
Position: General-Coordinator for Institutional and International Relations
Telephone: (+5561) 2025-8138
E-mail: eduardo.salgado@anpd.gov.br
Address: Setor Comercial Norte – SCN, Quadra 6, Conjunto A, Edifício Venâncio 3000, Bloco A, 9º andar, CEP 70.716-900 – Brasília – DF, Brazil

4.1.2. For PCC:

Name: Miguel Bernal-Castillero
Position: Director
Telephone: 613-793-6941
E-mail: Miguel.Bernal-castillero@priv.gc.ca
Address: 30 Rue Victoria, Gatineau, Quebec J8X 2A1, Canada

4.2. Each Participant may change its designated points of contact for the purposes of this Memorandum upon notice in writing to the other Participant.

Clause five – Costs

5.1. Actions arising from this Memorandum will be provided in a mutual cooperation regime.

5.2. Unless otherwise decided by the Participants, the Requested Participant will pay all costs of executing the Request.

5.3. When the cost of providing or obtaining information under this Memorandum is substantial, the Requested Participant may ask the Requesting Participant to pay for those costs as a condition of proceeding with the Request.

5.4. In case of an event as the one referred to in item 5.3, the Participants will consult on the issue upon request of either Participant.

Clause six – No sharing of personal data and information

6.1. Participants will only share personal data and information pursuant to this Memorandum in accordance with each Participant’s Applicable Law and to the extent that it is necessary for fulfilling the purposes of this Memorandum. When sharing personal data or information, Participants will, wherever possible, use best efforts to obtain the consent of the individual(s) concerned before doing so.

6.2. If the Participants wish to share personal data and information, for example in relation to any cross-border matter involving both jurisdictions, each Participant shall consider compliance with its own Applicable Law, which may require the Participants to enter into a specific written agreement for that purpose.

Clause seven – Retention of information

7.1. Information received under this Memorandum will not be retained for longer than is required to fulfill the purpose for which it was shared or than is required by the Requesting Participant’s country’s laws.

7.2. The Participants will use best efforts to return any information that is no longer required if the Requested Participant makes a written request that such information be returned.

7.3. If no request for return of the information is made, the Requesting Participant will dispose of the information using methods prescribed by the Requested Participant or if no such methods have been prescribed, by other secure methods, as soon as practicable after the information is no longer required.

7.4. The Participants will only share information pursuant to this Memorandum to the extent necessary to fulfill its purposes.

7.5. The Requesting Participant will not use any information obtained from the Requested Participant for purposes other than those for which the information was originally shared.

Clause eight – Confidentiality

8.1. Information shared under this Memorandum is to be treated as confidential and will not be further disclosed without the consent of the other Participant.

8.2. Where confidential material is shared between the Participants it will be marked with the appropriate security classification.

8.3. The Participants undertake to maintain in absolute secrecy all confidential information to which they become aware or have access due to the execution of this Memorandum, except with written authorization from the Participant who transmitted it.

8.4. Confidential information will be used exclusively for the specific purposes provided for in this Memorandum.

8.5. The Participants will oppose, to the fullest extent possible in accordance with their countries’ laws, any application by a third party for disclosure of confidential information or materials received from the Requested Participant, unless the Requested Participant consents to its release.

8.6. The Participant who receives any application by a third party for disclosure of confidential information will notify forthwith the Requested Participant, which provided it with the confidential information.

Clause nine – Data breach reporting

9.1. Appropriate security measures shall be agreed in specific cases to protect information transfers in accordance with the sensitivity of the information and any classification which is applied by the sender.

9.2. Each participant will use best efforts to safeguard the security of any information received under this Memorandum and respect any safeguards agreed to by the Participants.

9.3. In the event of any unauthorized access or disclosure of the information, the Participants will take all reasonable steps to prevent a recurrence of the event and will promptly notify the other Participant of the occurrence.

9.4. Where confidential material obtained from, or shared by, the Requested Participant is wrongfully disclosed or used by the Requesting Participant, the Requesting Participant will bring this to the attention of the Requested Participant without delay.

Clause ten – Legal limitations and legal nature of this memorandum

10.1. The Requested Participant may exercise its discretion to decline a request by the Requesting Participant for assistance, or limit or condition its cooperation, in particular where it is outside the scope of this Memorandum, or more generally where it would be inconsistent with domestic laws, or important domestic interests or priorities.

10.2. The Requesting Participant may request the reasons for which the Requested Participant declined or limited assistance or cooperation.

10.3. Nothing in this Memorandum is intended to:

1. create binding obligations, or affect existing obligations under international law, or create obligations under the laws of the Participants’ respective countries of jurisdictions;
2. prevent a Participant from seeking assistance or cooperation from; or from providing assistance to another Participant pursuant to other legal instruments;
3. affect any right of a Participant to seek information on a lawful basis from a Person located in the territory of the other Participant’s country, nor is it intended to preclude any such Person from voluntarily providing information obtained under local law;
4. create obligations or expectations of assistance or cooperation that would exceed a Participant’s jurisdiction.

Clause eleven – Publicity and disclosure

11.1. Publicity resulting from actions arising from this Memorandum of Understanding must be educational, informative, or socially orientated, and cannot contain names, symbols or images that characterize personal promotion of authorities or public servants of both Participants.

Clause twelve – Alterations

12.1. This Memorandum may be modified, in whole or in part, by the issuance of a written Amendment or Addendum signed by the Participants, provided that its object is maintained.

Clause thirteen – Duration of cooperation

13.1. The term of this Memorandum of Understanding shall be five (5) years from the date of the last signature and may be extended for a single period of equal length, by means of an Amendment or Addendum, or by mutual agreement, to be executed by the Participants during the term of this instrument.

13.2. This instrument may be terminated for cause, at any time by either Participant, upon written notice to the other Participant, with at least sixty (60) days' prior notice.

13.3. The assistance provided under this Memorandum shall apply to Covered Privacy Contraventions that occur before or after the execution of this Memorandum.

13.4. Upon termination of this Memorandum, the Participants will, in accordance with Clauses Six and Eight, maintain the confidentiality of any information communicated to them by the other Participant in accordance with this Memorandum, and return or destroy, in accordance with the provisions of Clause Seven, information obtained from the other Participant in accordance with this Memorandum.

Clause fourteen – Dispute settlement

14.1. Participants will use their best efforts to resolve any disagreements which may arise under this Memorandum through the contacts designated under Clause Four.

14.2. Failing resolution between the contacts in a reasonably timely manner, conflicts will be resolved by discussion and negotiation between the heads of the Participants.

Clause fifteen – Unforeseen events

15.1. Situations not provided for in this Memorandum will be resolved by mutual agreement between the Participants, aiming at the full execution of its object.

Clause sixteen – Electronic signature

16.1. The execution of this Memorandum of Understanding by electronic and digital means is recognized by both Participants as valid and fully effective when both participants have signed this Memorandum.

Signed in Portuguese, English and French, each version being equally valid, with same form and content. In the event of a conflict in interpretation, the English version is the primary authority.