Article 3

1.The Commission shall continuously monitor the application of the legal framework upon which this Decision is based with a view to assessing whether Brazil continues to ensure an adequate level of protection within the meaning of Article 1.

2.The Member States and the Commission shall inform each other of cases where the Brazilian Data Protection Authority (Agência Nacional de Proteção de Dados – ANPD), or any other competent Brazilian authority, fails to ensure compliance with the legal framework upon which this Decision is based.

3.The Member States and the Commission shall inform each other of any indications that interferences by Brazilian public authorities with the right of individuals to the protection of their personal data go beyond what is strictly necessary, or that there is no effective legal protection against such interferences.

4.After four years from the date of the notification of this Decision to the Member States and subsequently at least every four years, the Commission shall evaluate the finding in Article 1 on the basis of all available information, including the information received as part of the review carried out together with the relevant Brazilian authorities.

5.Where the Commission has indications that an adequate level of protection is no longer ensured, the Commission shall inform the competent Brazilian authorities and may suspend, repeal, or amend this Decision.

6.The Commission may also suspend, repeal, or amend this Decision if the lack of cooperation of the Brazilian government prevents the Commission from determining whether the finding in Article 1 of this Decision is affected.