- Many businesses will need to adapt to the new law, looking at the M&A environment rather than customer data transfers.
- With the LGPD, the business environment will have more clarity about the regulations to be made a clearer perspective for foreign investors who want to come to Brazil.
- Digital technologies enable a remote-working online scenario that is perfect for generating wealth and reviving the economy.
On September 18, 2020, the General Data Protection Act – the LGDP – became law in Brazil. Inspired by the European GDPR, the ultimate goal of this law is to ensure personal data protection. The document applies to all operations with personal data conducted by private companies, public agencies, or even individuals, online or offline, regardless of the country where those responsible for the application are or the data’s location.
To discuss this legislation’s impact on businesses and transactions, the M&A Community held a webinar on the subject at the end of last year.
The feeling is that there is still a long way to go until companies reach full compliance. To approach the matter in more detail, we talked to one of the webinar participants, Thiago Luís Santos Sombra, Partner in the technology and digital businesses area at Mattos Fillhos.
How does the LGPD change international M&A business in Brazil? What must participants be prepared for?
We understand that the new law brings a new regulation scenario to Brazil as being the most relevant change. First of all, many businesses will need to adapt to the law, looking at the whole M&A environment rather than just customer data transfer. Moreover, LGPD impacts product development and the launch of new businesses.
I’ll give you one example: Let’s say I’m developing a new product, a new marketplace platform. Structuring this new product, thinking it through, and conceiving this platform will now have to include reviewing the best practices in personal data protection. Thus, I will increasingly need to collect data to transport my ‘physical’ business model to a digital platform, where I need to understand people’s choices and profiles better.
Companies must adapt to the law. When I look at a business that was a restaurant or a gym, which offered physical services and which started to migrate to a virtual environment, I must learn or understand which personal data will be collected to provide better products and more personalized services. This is the reality. From this perspective, one has to understand the General Data Protection Act regulation in a business environment.
There is a movement behind the LGPD and the US regulations. Do you think this could attract more foreign investments to Brazil?
Yes, indeed, chiefly technological and M&A companies that are looking for opportunities in Brazil. With the LGPD coming into force and the regulatory framework it provides, there will be more legal security. After all, with the LGPD, the business environment will have more clarity on the regulations to be made, thus a clearer perspective for foreign investors who want to come to Brazil.
In addition to those you mentioned, how does the LGPD impact on international M&A business in Brazil?
There is an impact associated with data transfer to other jurisdictions. The European legislation for data protection regulates specifically how European companies, which are part of companies from other countries, will offer goods and services within the European territory. It is the same for the legislation of other countries like Canada, Australia, and Asian countries. With the Brazilian law, foreign investors operating in different jurisdictions will need to understand how these processes and transfers will now occur. This will create a more specific point of attention for companies with international operations, even whether they were established in Brazil or not.
What specific challenges does LGPD present to a technological business, that is, a digital company that deals with Big Data and AI? How are privacy and data protection issues associated with AI addressed in this context?
Despite what one might think, the LGPD did not arrive and create the problem of a regulatory bottleneck for new technologies like AI, Blockchain, and other tools. It came to deliver an environment with security and stability. Obviously, technology companies will need to understand the law’s impacts on them better to allow them to work with personal data.
One example is the need to collect personal data in greater amounts to understand public profiles better. For instance, companies want to understand their target audiences better for ad and marketing campaigns.
Security breaches and data leaks: How are they addressed in the new law? Was the market in general, especially considering M&A for small and medium companies, prepared for that?
There is a long road ahead. The law does not bring a clear perspective on how small companies should adapt and have a greater understanding of Brazil’s business environment. So, it is important that the regulation brings with it much more clarity and an adaptation period that is consistent with a company’s size and profile.
Micro and small companies, for example, have greater difficulty seeing or adapting, given their limitations, not only the financial constraints in a pandemic year but the number of people that are in charge of these problems. It is crucial to adopt a perspective for that.
Privacy and data protection laws seem to be a new trend trying to follow growing IT capacities. How do you see the future of such regulations?
We are migrating to a new economic development model, a data-driven economy. We have already had a model based on coal and horsepower. Now we are entering a data-driven economy. The energy matrix for wealth generation will be personal data.
It is very natural to have, in most different jurisdictions, a considerable growth of laws that attempt to regulate new technologies like AI, personal data protection, cybersecurity, and Blockchain. This is the focus of attention in the new developmental model.
I can’t imagine a better scenario to generate wealth and retake the economy other than that which we are experiencing today. Without leaving home, a person can perform their activities in a digital format, generate wealth, employ several people, and have the capacity to deliver products anywhere.
This new model does not require physical assets, like a car, a store, a location. Through a single device, it is possible to offer a whole range of services and expertise to people in several areas worldwide. It is a trend where we will have more intense behavior regulation than in other spheres.
Will M&A transactions be more restricted by the new rules?
In terms of M&A, we will have a scenario with more freedom because the only particular concerns transferring the personal data of assets involved in a specific transaction. When we look at a scenario like this, it is very likely that the impact on M&A will involve basically those companies with large amounts of personal data and that are subject to certain types of transactions.
