The “Schrems II” case and its possible effects in brazilian law

The information flow between different countries represents a striking feature of State sovereignty and of contemporary businesses’ activities, which often implies the need to transfer citizen’s personal data from one country to another. Aiming to safeguard the interests of the economic block and protecting the fundamental rights of European citizens, the Court of Justice of the European Union recently analyzed the complaint of an Austrian lawyer regarding the breach of the European General Data Protection Regulation (GDPR) guidelines, which resulted in the recognition of invalidity of standard contractual clauses that, until then, supported acts of international transfer of personal data from Europe to the United States, a case that became known as “Schrems II”. Considering the similarities between GDPR and LGPD, the Brazilian General Data Protection Law (Law No. 13709/2018), there was a hypothetical possibility of a decision equivalent to that issued by the European Court, based on the Brazilian law and its possible consequences in the Brazilian context. Therefore this study aims to investigate the “Schrems II” case and point out that LGPD mirrored the framework brought by GDPR regarding the criteria for the lawful transfer of data internationally. Furthermore, due to the rules provided for in the LGPD for the international transfer of personal data, Brazil can both victimize and be a victim of cases of revocation of standard contractual clauses, hindering operations and commercial relations, although the regulation of this topic is still needed from the competent Authority.