Welcome to another issue of CTPI Weekly, your premium newsletter on tech design and policy.

Today we'll cover:

Privacy, and autonomy
Policy red flags;
FedNow adoption chasm, and much more.

This week, we are discussing two examples of regulatory intervention that could greatly impact technology companies' businesses. In the first example, policy debates around privacy and autonomy principles could determine regulatory authorities' power and limit a market's potential. In the second example, regulatory intervention could be precisely what a market needs to open up and embrace competition, innovation, and inclusion. To understand when regulations expand and when they limit the potential positive impact of a market, we must take a step back and analyze how second-order consequences play out in a system.

Now, let's get to it.

M. and J.

The price of freedom is eternal vigilance

Photo by Jonas de Abreu

A few weeks ago, we discussed a few cases where European regulation removed from individuals the choice to consent to data processing. In these cases, limitations take place even if the data owner agrees with the company's privacy policy if the service provider is based outside of the EU. In particular, regarding cross-border personal data transfers, we said:

The important lesson here is that this is not a consent deficiency. EU authorities have the position that consent is not enough to process European personal data. In doing so, law enforcement is now coercing privacy upon their citizens. (…)

To be fair, that is not an explicit position from the European authorities, although there is no reference to autonomy as a guiding principle in GDPR. In any case, EU data protection regulators are effectively stripping Europeans from the freedom of choice of service because they don't tolerate that a citizen could accept a different choice of law in exchange for services.

Today, our attention turns to Brazil, where the debate around international data transfers came back into the spotlight. The regulation in Brazil has been heavily influenced by Europe. Their General Data Protection Act (LGPD in Brazilian portuguese) is, in many aspects, a transposition of GDPR. Nevertheless, having the benefit of learning from the EU's experience and balancing influences from other jurisdictions, LGPD presents some noticeable differences.

In particular, LGPD has the virtue of explicitly acknowledging the role of other fundamental rights in defining the borders of privacy rights. Such is the case of autonomy and freedom of expression. In fact, data protection in Brazil is heavily associated with the concept of informational self-determination — that is, the attribute of an individual to determine what happens to their own data.

One of the places where this special definition of data protection comes into play is, of course, in the discipline of international data transfers. Differently from the EU, legislators in Brazil decided to honor the individual's autonomy to decide how they can manage their personal data. So it shouldn't come as a surprise the fact that the LGPD explicitly recognizes specific, informed consent as one of the legal bases to share personal data cross-border. Note: we won't bore you with a direct citation from the law, but you can check out art. 33 here if that's your cup of tea.

More recently, this debate was reignited by the Brazilian National Authority for Data Protection as it opened a call for comments on a draft regulation governing cross-border data transfers

From the National Authority for Data Protection:

“This Tuesday (15/08), a public consultation was published on the draft Resolution regarding the Regulation of International Transfers of Personal Data and the model of Standard Contractual Clauses (…) The Consultation will be available on the Participa Mais Brasil platform between August 15th and September 14th. (…)

The Draft Resolution aims to regulate the transfer of personal data to foreign countries or international organizations of which Brazil is a member, as well as the models of Standard Contractual Clauses (CPC), the flow of approval of Specific Clauses (CE) and Global Corporate Standards (GNC), in addition to the Adequacy Decision mechanism”.

The draft regulation does not cover cases where an individual provides informed, specific, and highlighted consent. The regulation is intended to target cases where such specific consent is not provided. The draft is explicit in stating that nothing in the regulation excludes the possibility of justifying international data transfers on consent alone.

So why are we even discussing this? There are two reasons.

The first is the risk of courts being misled into thinking that although user consent is a separate basis for international data transfer, some other additional conditions must also be met. This is common in politically charged debates, such as when a state agenda is disguised as an individual's rights. This is the case when privacy issues are used as an excuse in conflicts of jurisdiction between two allied countries.

We should note that the informational self-determination clause in the LGPD did not come about by accident. It resulted from a fierce debate and prevailed over several attempts to give the government the ability to decide what data processing is admissible. So make no mistake: this time will not be different, and anyone who may be affected by this should take action in the debate.

The second reason is that this is a cautionary tale, my friends. It serves as a reminder that no matter how many times a debate is won, there will always be a risk of removing freedoms and limiting rights. Keep your radars up! We certainly will.

Will FedNow be pushed to P2M payments?

Photo by Pixabay

We've been writing about Pix for a while now, and, more recently, we wrote about our early impressions of FedNow. Since then, we've received many questions about how Pix and FedNow compare.

One important difference between FedNow and Pix is that Pix was designed to be ubiquitous. From the outset, regulators mandated that institutions with 500k+ accounts participate, covering over 90% of the active accounts in the country.

This was crucial because the largest players had little incentive to join voluntarily. They benefited from a walled garden model for the payment market, where the size of the network was the most important feature of a payment system. The old cost structures were also beneficial for incumbents who made money from MDR, interchange fees, and network fees.

With a centralized infrastructure like Pix, the size of each individual player stops being a competitive advantage because any player, regardless of its size, can send and receive payments from any other account. Moreover, the rail as a whole depends on fewer intermediaries, so the business model around payments requires some redesigning.

Now, of course, we should note that the US market is far less concentrated than the Brazilian market. But is that enough to break the inertia so that all major players participate? That seems to be the biggest question about FedNow's future.

Privacy and autonomy, and more on FedNow