Data Protection Public Policies: An Analysis of the Court of Justice of the European Union's Decisions and Their Possible Implications for Brazil

Júlia Oselame Graf; Caroline Müller Bitencourt

doi:10.35319/lawreview.202517105

Authors

Júlia Oselame Graf UNISC https://orcid.org/0000-0002-2662-6963
Caroline Müller Bitencourt UNISC https://orcid.org/0000-0001-5911-8001

DOI:

https://doi.org/10.35319/lawreview.202517105

Keywords:

LGPD, Data Protection, Public Policies, GDPR, CJEU

Abstract

This article investigates the extent to which the case law of the Court of Justice of the European Union (CJEU) can serve as an interpretive parameter for the application of Brazil’s General Data Protection Law (LGPD). A hypothetical-deductive method, in a comparative perspective, is adopted to analyze fourteen landmark CJEU judgments selected for their relevance in consolidating the principles of the General Data Protection Regulation (GDPR). The analysis demonstrates how the foundations established by the CJEU interact with the normative structure of the LGPD in key areas of data protection, allowing the identification of significant convergences. The results show that these points of contact provide useful references for the actions of the Brazilian National Data Protection Authority, both in issuing regulations and in supervising and encouraging best practices, thereby strengthening public policies aimed at data protection in Brazil, without implying an automatic transposition of European jurisprudence.

Downloads

Download data is not yet available.

Author Biographies

Júlia Oselame Graf, UNISC

PhD student in Law at the University of Santa Cruz do Sul - UNISC. Scholarship from PROSUC/CAPES Modality II. Degree student in Digital Marketing and Data Science at the Centro Universitário FAM. Master’s degree in Law and Social Justice from the Federal University of Rio Grande - FURG. Undergraduate studies in Law at the Federal University of Rio Grande - FURG, including a sandwich period at the Faculty of Law at the University of Porto in Portugal. Postgraduate qualifications in Social Security Law, Civil Procedure, and Medical and Health Law. Lawyer. E-mail: juliagrafadv@gmail.com. ORCID: https://orcid.org/0000-0002-2662-6963

Caroline Müller Bitencourt, UNISC

Ph.D. in Law from the University of Santa Cruz do Sul. Post-doctorate from PUC/PR. Specialization in Public Law. Tenured Professor at the Graduate Program in Law - Master's and Doctorate - UNISC. Head of the Department of Law at the University of Santa Cruz do Sul. Member of the Euro-Latin American Faculty Network of Administrative Law. Member of the Social Administrative Law Network. Coordinator of the research group on social and administrative control of public policies and public service. Member of the Human Development Research Group at PUC/PR. Lawyer. E-mail: carolinemb@unisc.br. ORCID: https://orcid.org/0000-0001-5911-8001

References

Borchardt, K.-D. (2011). O ABC do direito europeu. Publications Office of the European Union.

Castells, M. (2002). A sociedade em rede. Paz e Terra.

Doneda, D. (2020). Da privacidade à proteção de dados pessoais: elementos da formação da Lei Geral de Proteção de Dados. Thomson Reuters Brazil.

Ferraz Júnior, T. S. (1993). Sigilo de dados: o direito à privacidade e os limites à função fiscalizadora do Estado. Revista da Faculdade de Direito, Universidade de São Paulo, 88, 439–459. https://www.revistas.usp.br/rfdusp/article/view/67231

Lynskey, O. (2015). The Foundations of EU Data Protection Law. Oxford University Press.

Rodotà, S. (2008). A vida na sociedade da vigilância: a privacidade hoje. Renovar.

Sarlet, I. W. (2021). Fundamentos constitucionais: o direito fundamental à proteção de dados. En D. Doneda et al. (Eds.), Tratado de proteção de dados pessoais. Forense.

Tamò-Larrieux, A. (2018). Designing for Privacy and its Legal Framework: Data Protection by Design and Default for the Internet of Things. Springer Nature.

Ureta, A. (2021). Princípio do primado no direito da União Europeia. In Estudos de Direito Europeu. Editora ABC.

Van Dijk, J. (2006). The Network Society: Social Aspects of New Media. Sage.

Brazil. Decreto no 8.777, de 11 de maio de 2016 [Decree No. 8.777 of May 11, 2016]. Diário Oficial da União. https://www.planalto.gov.br/ccivil_03/_Ato2015-2018/2016/Decreto/D8777.htm

Brazil. Decreto no 9.637, de 26 de dezembro de 2018 [Decree No. 9.637 of December 26, 2018]. Diário Oficial da União. https://www.planalto.gov.br/ccivil_03/_Ato2015-2018/2018/Decreto/D9637.htm

Brazil. Decreto no 10.222, de 5 de fevereiro de 2020 [Decree No. 10.222 of February 5, 2020]. Diário Oficial da União. https://www.planalto.gov.br/ccivil_03/_Ato2019-2022/2020/Decreto/D10222.htm

Brazil. Emenda Constitucional no 115, de 10 de fevereiro de 2022 [Constitutional Amendment No. 115 of February 10, 2022]. Diário Oficial da União. https://www.planalto.gov.br/ccivil_03/constituicao/emendas/emc/emc115.htm

Brazil. Lei no 13.709, de 14 de agosto de 2018 [General Data Protection Law – LGPD]. Diário Oficial da União. https://www.planalto.gov.br/ccivil_03/_Ato2015-2018/2018/Lei/L13709.htm

Brazil. Lei no 13.853, de 8 de julho de 2019 [Law No. 13.853 of July 8, 2019]. Diário Oficial da União. https://www.planalto.gov.br/ccivil_03/_Ato2019-2022/2019/Lei/L13853.htm

Brazil. Lei no 14.129, de 29 de março de 2021 [Digital Government Law]. Diário Oficial da União. https://www.planalto.gov.br/ccivil_03/_Ato2019-2022/2021/Lei/L14129.htm

Brazil. Medida Provisória no 869, de 27 de dezembro de 2018 [Provisional Measure No. 869 of December 27, 2018]. Diário Oficial da União. https://www.planalto.gov.br/ccivil_03/_Ato2015-2018/2018/Mpv/mpv869.htm

Brazil. Ministry of Justice and Public Security. (n.d.). Legal basis of the organizational structure and competencies of the National Data Protection Authority. Government of Brazil. https://www.gov.br/anpd/pt-br/acesso-a-informacao/institucional/base-juridica

Court of Justice of the European Union (Second Chamber). Breyer v. Bundesrepublik Deutschland, C-582/14, ECLI:EU:C:2016:779 (Oct. 19, 2016). https://curia.europa.eu/juris/document/document.jsf?docid=184668&doclang=EN

Court of Justice of the European Union (Judgment of the Court). Costa v. ENEL, 6/64, ECLI:EU:C:1964:66 (July 15, 1964). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:61964CJ0006

Court of Justice of the European Union (Grand Chamber). Data Protection Commissioner v. Facebook Ireland and Maximilian Schrems (Schrems II), C-311/18, ECLI:EU:C:2020:559 (July 16, 2020). https://curia.europa.eu/juris/document/document.jsf?docid=228677&doclang=EN

Court of Justice of the European Union (Grand Chamber). Digital Rights Ireland Ltd and Seitlinger and Others, Joined Cases C-293/12 & C-594/12, ECLI:EU:C:2014:238 (Apr. 8, 2014). https://curia.europa.eu/juris/document/document.jsf?docid=150642&doclang=EN

Court of Justice of the European Union (Second Chamber). Fashion ID GmbH & Co. KG v. Verbraucherzentrale NRW eV, C-40/17, ECLI:EU:C:2019:629 (July 29, 2019). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040

Court of Justice of the European Union (Grand Chamber). Google LLC v. Commission nationale de l’informatique et des libertés (CNIL), C-507/17, ECLI:EU:C:2019:772 (Sept. 24, 2019). https://curia.europa.eu/juris/document/document.jsf?docid=218105&doclang=EN

Court of Justice of the European Union (Grand Chamber). Google Spain SL and Mario Costeja González v. Agencia Española de Protección de Datos, C-131/12, ECLI:EU:C:2014:317 (May 13, 2014). https://curia.europa.eu/juris/document/document.jsf?docid=152065&doclang=EN

Court of Justice of the European Union (Grand Chamber). La Quadrature du Net and Others, Joined Cases C-511/18, C-512/18 & C-520/18, ECLI:EU:C:2020:791 (Oct. 6, 2020). https://curia.europa.eu/juris/document/document.jsf?docid=232084&doclang=EN

Court of Justice of the European Union (Judgment of the Court). Lindqvist, C-101/01, ECLI:EU:C:2003:596 (Nov. 6, 2003). https://curia.europa.eu/juris/document/document.jsf?docid=48382&doclang=EN

Court of Justice of the European Union (First Chamber). OQ v. Land Hessen (SCHUFA Holding AG intervening), C-634/21, ECLI:EU:C:2023:950 (Dec. 7, 2023). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634

Court of Justice of the European Union (Judgment of the Court). Politi s.a.s. v. Ministry for Finance of the Italian Republic, 43/71, ECLI:EU:C:1971:122 (Dec. 14, 1971). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:61971CJ0043

Court of Justice of the European Union (Third Chamber). Scarlet Extended SA v. Société belge des auteurs, compositeurs et éditeurs (SABAM), C-70/10, ECLI:EU:C:2011:771 (Nov. 24, 2011). https://curia.europa.eu/juris/document/document.jsf?docid=115202&doclang=EN

Court of Justice of the European Union (Judgment of the Court). Van Duyn v. Home Office, 41/74, ECLI:EU:C:1974:133(Dec. 4, 1974). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:61974CJ0041

Court of Justice of the European Union (Judgment of the Court). Van Gend en Loos v. Nederlandse Administratie der Belastingen, 26/62, ECLI:EU:C:1963:1 (Feb. 5, 1963). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:61962CJ0026

Court of Justice of the European Union (Grand Chamber). Wirtschaftsakademie Schleswig-Holstein v. Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, C-210/16, ECLI:EU:C:2018:388 (June 5, 2018). https://curia.europa.eu/juris/document/document.jsf?docid=202543&doclang=EN