Is it worthwhile for Latin American countries to obtain adequate level of personal data protection from the European approach, or is it better to promote the use of contractual clauses to export such information?

Abstract

The international transfer of personal data between countries with diverse legal cultures is set to continue growing as social and economic relationships expand alongside the increasing number of internet users and the widespread adoption of information and communication technologies worldwide. This paper proposes to re-evaluate the emphasis on the “adequate level of data protection” as a strategy to ensure the minimum standards for the proper handling of personal data when exported to other countries. Instead, it suggests that standard data protection clauses might be a more effective approach to achieve this objective. Ensuring an adequate level of data protection is essential for all countries. However, this does not necessarily mean that such a level can only be attained by adhering to processes established by foreign organisations or local authorities from other nations. The absence of a formal certification of an adequate level does not imply that a country lacks the effective mechanisms to ensure proper personal data treatment. The lengthy duration and high uncertainty associated with the adequacy processes are inconvenient for entities that need to legally export personal data to other countries. Therefore, standard data protection clauses are presented as a practical and sensible tool to achieve this goal. It is highly likely that the use of these clauses will eventually replace the need to rely on the “adequate level of data protection” framework.