A glass half full look at the Brazilian Data Protection Authorithy

In any data protection system, the regulatory institution – called the National Data Protection Authority – plays a substantial role. In Brazil, this institution was created in a different way from what had originally been expected. Therefore, the legal literature started to criticize it and to doubt its ability to satisfactorily exercise its regulatory powers. Even before the Brazilian general data protection act came into effect, a major opinion was formed around the idea that, in its current structure, the Brazilian Data Protection Authority (BDPA) would fail. The author of this paper intends to provide a different view on the subject. Amid the uncertainty, he opted for looking at the glass “half full” instead of seeing it “half-empty”. He highlights that even in its current format the BDPA is remarkable progress and could be very useful to the Brazilian personal data protection system. After all, more important than the structure of the regulatory body are its capacities and how they will be exercised in practice. To provide this text with a scientific basis, the author conducted a structuralist analysis drawing a comparison between the Brazilian Data Protection Authority and the equivalent institution in Uruguay (URCDP), which has a very similar structure and has been carrying out its duties with success for over a decade. In the end it was possible to demonstrate that the initial structure of the BDPA is not a barrier that could prevent it from carrying on its duties. Therefore, it is prudent to trust the BDPA and monitor how it will operate.