Operators in the sports betting and online gaming segment may have systems abroad as long as they have an International Judicial Cooperation Agreement with Brazil, covering both civil and criminal matters.
Additionally, they must comply with the General Data Protection Law (LGPD). The Secretariat of Prizes and Betting (SPA) may request additional information from the operator at any time.
This is another step taken by the federal government in the process of regulating this sector, but it does not represent approval of any operator, a step that will only be addressed in the future.
Lawyer Caio de Souza Loureiro, who works in the field, says that the solution found by the government addresses two relevant concerns: ensuring effective control by the country on one hand, and avoiding unnecessary costs on the other.
"Although the obligation to install data centers in the country better meets the first point, it results in additional expenses that could deter globally established operators," he said.
According to Loureiro, these operators already have robust structures, and installing another one could drive them away from the country. "By linking the permission to install outside Brazil to countries with civil and criminal judicial cooperation agreements, the regulation maintains the effectiveness of supervision and any measures by Brazilian authorities," he says.
Expert Jun Makuta also considered the ordinance positive but pointed out that a potential problem is that the condition requiring the existence of an international cooperation agreement in civil and criminal matters between Brazil and the host country of the data center, in practice, ends up significantly reducing the number of operators exempt from the obligation.
"Although Brazil is a party to several multilateral or bilateral international agreements, they refer only to criminal or civil matters separately, with few countries being parties to treaties that separately cover both areas," Makuta explained.
Lawyer Breno Ávila de Souza Pereira pointed out that the measure "facilitates the operation of betting and does not represent a violation of the rights of bettors," considering that various protective rules must be observed, especially ensuring that the bettor expressly agrees to the international transfer of their personal data.
Pereira also emphasized that the requirement for countries to be signatories to an International Judicial Cooperation Agreement with Brazil, covering both civil and criminal matters, facilitates potential accountability of companies.
César Garcia, CEO of a company in the field, highlighted that the flexibility of databases and systems abroad, unlike what was initially proposed in the drafts, gave "financial breathing room" to operators.
"The new rule allows for the establishment of redundancies and best practices in data governance and system integrity, reducing the risk of disasters that could lead to the permanent loss of personal and financial data of bettors, as experienced previously, leading the system to some collapse, such as that which occurred on September 11, 2001," Garcia said.
Other regulations
The owner must previously authorize the international transfer of personal data, and the Treasury must have secure and unrestricted access, remotely and in person, to the systems, platforms, and operation data.
Another obligation for the operating agent is to present a Business Continuity Plan for Information Technology (IT) in the event of critical situations that may jeopardize the operation and data, containing, at least: mapping of likely loss scenarios; identification, analysis, and evaluation of risks; prevention and mitigation actions; and designation of responsible parties.
Finally, the data center used must have ISO 27001 certification.
Betting regulation
The law regulating the betting market was sanctioned by President Lula (PT) at the end of 2023, but it was not until the end of April that the Secretary of Prizes and Bets, lawyer Regis Dudena, was appointed. The secretariat had been functioning since the end of January but with an interim head.
Finance is responsible for regulating various issues related to fixed-odds betting lottery. At the moment, the Secretariat of Prizes and Betting prioritizes the regulation that will discipline the rules and conditions for obtaining authorization to explore the market in Brazil.
Once this regulation is disclosed, the evaluation process of interested legal entities will begin, which will require, among other things, integrity and prevention policies against result manipulation and other frauds.
In a preliminary expression of interest, more than 130 companies have come forward with the intention of operating in the Brazilian market.
The ministry emphasizes that the law established a period of no less than six months for legal entities operating in Brazil to comply with legal and regulatory provisions.
Source: Metrópoles
