Inter-agency coordination and digital platform regulation: lessons from the Whatsapp case in Brazil

ABSTRACT

This article examines the drivers and obstacles behind the first large-scale cross-agency coordination in digital platform regulation in Brazil. Drawing on elite semi-structured interviews and document analysis, it investigates how the Brazilian National Data Protection Authority (ANPD) and other federal agencies worked together to scrutinize the legal implications of WhatsApp’s privacy policy and terms of service changes announced in January 2021, including concerns regarding transparency, legitimate interest, and consent. The study reveals that while formal institutional arrangements such as cooperation agreements existed, informal factors like personal relationships played a significant role in facilitating coordination. However, capacity and autonomy issues within the involved bodies hindered more substantive coordination and may explain divergences in the interpretation of data protection legislation. The findings emphasize the importance of enhancing mechanisms for inter-agency coordination in digital platform regulation, especially considering capacity and autonomy issues within and across regulatory ecosystems, offering insights to other jurisdictions, particularly for developing countries facing public governance constraints similar to those experienced in Brazil.

KEYWORDS:

• inter-agency coordination
• digital platforms
• regulation
• WhatsApp
• Brazil‌

1. Introduction

In January 2021, Brazilian WhatsApp users were faced with a decision: either accept the updated terms of service by 8 February, when the new rules would come into force, or risk losing access to the app. Amongst the changes, the updated terms of service highlighted that Facebook might gain access to WhatsApp data, including the content of conversations, to facilitate interactions between companies and users.¹ The ultimatum presented to users caused confusion and fueled a public debate on matters of transparency, data sharing, and consent.² With over 146 million WhatsApp users in Brazil at that time,³ the nation was particularly attuned to these concerns, driven in part by the ongoing implementation of a general data protection law and the recent establishment, just the year before, of its National Data Protection Authority (ANPD).

Amidst the lack of clear information about the implications of the changes, the Brazilian Consumer Protection Institute (IDEC) intervened in the public debate. On 31 March, IDEC sent a letter to the ANPD, the National Consumer Secretariat (SENACON), and the Federal Public Prosecutor’s Office (MPF) working with the Administrative Council for Economic Defense (CADE) raising issues with WhatsApp’s data processing practices and the app’s compliance with Brazilian law.⁴ IDEC’s letter had a significant development: it triggered the first-ever large-scale inter-agency cooperation around a digital platform case in Brazil.

In May 2021, four federal organizations jointly issued a set of recommendations addressed to WhatsApp and Facebook, which included recommendations related to the messaging application’s new terms, and Facebook’s processing of data.⁵ Notably, the document included a request for the companies to refrain from any form of data processing or sharing based on the announced changes until regulatory authorities had examined the matter. Twelve months later, in May 2022, following a series of interactions, the four organizations – a group that became known as ‘the quartet’ – released the minutes of their final meeting, detailing the positions of each institution involved in the joint investigation, along with conclusions and required follow-up actions within their respective areas of focus.⁶ The document emphasized the cross-sectoral implications of data collection and processing by digital platforms and commended the ‘unprecedented nature’ of their own coordinated efforts. However, it also highlighted areas of disagreement and where approaches diverged based on how each institution interpreted its mandate. What prompted these four institutions to work together? What made their efforts unprecedented, and what lessons can be learned from their coordinated approach in this case?

This article offers an analysis of the WhatsApp case as a case study of coordination in the regulation of digital platforms in Brazil. Given the significant economic role of digital platforms and their presence across multiple jurisdictions, it is crucial for regulators and law enforcement agencies to understand the impact of data collection and processing by these platforms on various policy areas, and how they can work together to effectively regulate them. Yet there is limited empirical analysis on how public bodies interpret their mandates and responsibilities and interact with each other in this space. Drawing on elite semi-structured interviews and document analysis, this study reconstructs the conditions leading to institutional coordination in the WhatsApp case and discusses the challenges that emerged during their joint work.

The case study integrates perspectives from all organizations of the quartet, with a specific emphasis on the role of the ANPD, the newest participant, and the challenges it has confronted since gaining regulatory autonomy. While there have been plans to create the agency since the adoption of the Brazilian Data Protection Law (Lei Geral de Proteção de Dados – LGPD) in 2018, the provisions in the LGPD that created the data protection authority were initially vetoed. A data watchdog was later created in 2020 as a government body subordinated to the office of the Presidency,⁷ but it was only on 14 June 2022 that then President Jair Bolsonaro enacted a Provisional Measure (MP) changing the legal framing of the ANPD, restructuring it as an autonomous agency.⁸

The analysis is informed by discussions on bureaucratic characteristics and their impact on governance outcomes to evaluate the relationship between agencies and regulators and the coordination that occurred in the WhatsApp case, drawing on literature that examines two dimensions of good public organizations: capacity and autonomy. Based on the examined data, this article highlights potential avenues to strengthen the capacity and autonomy of the ecosystem of public bodies involved in the case so that digital platforms are regulated more effectively in Brazil.

This is particularly relevant given the ongoing legislative debates in Brazil around proposed legislation aimed at improving transparency and accountability of internet platforms and the disputes surrounding a core issue: the creation of an autonomous regulatory entity responsible for overseeing the enforcement of future platform regulation rules. While the article does not directly address this ongoing issue, the study provides lessons that could be considered when examining options for the future of the institutional arrangement around digital platform regulation in Brazil. It emphasizes the importance of improving mechanisms of coordination between organizations, both formal and informal, and highlights the need to address concerns about capacity and autonomy expressed by interviewees, including issues related to regulatory capture.

1.1. Methodology

The analysis is informed by elite semi-structured interviews with actors who work or have worked in agencies and government bodies involved in the WhatsApp case, including ANPD, CADE, SENACON, and the MPF. The interviews were conducted in Brazilian Portuguese in March 2022, with a total of nine participants. Of these, six interviews were conducted in person, while three were conducted over video conference. Interviewees were provided with the interview protocol before the interview and gave their oral consent to participate in the research. They were also given the option to keep certain pieces of information off the interview record and, in some cases, to contribute anonymously.⁹ All interviews were audio recorded, transcribed, and then translated to English.

The interviews centered on legal and regulatory approaches to digital platforms, interactions between regulators and agencies with mandates over digital platforms, the coordination dynamics observed in the WhatsApp case, and the effectiveness of inter-agency coordination within the digital platform context more broadly. The transcripts of the interviews were manually coded to identify the interviewees’ perceptions of the reasons behind coordination decisions, how coordination occurred, and the specific steps and procedures involved. The evidence gathered through the interviews was triangulated with an analysis of publicly available documents, including technical notes, reports, press releases, technical cooperation agreements, administrative procedures, and decisions issued by the involved agencies and bodies.

The article is structured as follows: Section 2 describes the formal rules that were in force, setting procedures and mechanisms for cooperation between federal government organizations in general in Brazil, as well as the specific cooperation agreements in place between the four organizations involved in the WhatsApp case. Section 3 discusses the literature on measurements of governance and how they can help to explain the drivers and constraints faced by institutions that impact the way they are able to coordinate their efforts. Section 4 then discusses the substantive legal issues raised in the case, including the legal questions raised and the outcome of the investigations, including the recommendations published in the joint document by the four bodies. Section 5 discusses the findings from the interviews that illuminate how coordination evolved on the ground. Finally, the conclusion reflects on lessons learned from the case, and how they could inform the institutional design for digital regulation in Brazil and in other jurisdictions facing similar governance constraints.

2. The institutional setting of digital platform regulation in Brazil

In Brazil there is no body that has exclusive mandate to regulate digital markets (…) when it comes to digital markets, when we talk about the digital economy, new technologies, you end up having a horizontal cut and different policies in different economic sectors (interviewee 2)

As the above quote notes, there is no overarching regulator responsible for supervising digital platforms in Brazil. Instead, there are different agencies and regulators that share the responsibility for enforcing different sets of rules that apply to digital platforms, focusing on specific policy and legal areas.¹⁰

Given the issues that were raised in the WhatsApp case, four public sector organizations were involved in analyzing whether the changes in the terms of services were in compliance with Brazilian law. The ANPD was involved due to data protection concerns, as the agency is responsible for regulating the collection and processing of data by public and private entities in Brazil. Additionally, concerns related to market power and competition law, which fall under the purview of the Brazilian competition authority, CADE, were raised. From the perspective of consumer protection, SENACON was involved as the body of the Ministry of Justice responsible for the national consumer protection policy, which encompasses consumers’ rights both online and offline. Finally, the MPF was involved in the case. Although not a regulator, the MPF is responsible for enforcing federal laws to protect the public interest and the rights of citizens, so its mandate includes investigating and prosecuting offenses related to data and digital technologies.

Legal frameworks governing interactions among regulatory bodies, and formal agreements are in place, with a focus on fostering cooperation. The Brazilian Law of Regulatory Agencies (Law 13,848/2019) contains provisions on cooperation for regulatory agencies such as ANPD, but their primary focus is the exchange of experiences, editing normative acts, and notification of decisions, rather than active decision-making coordination. For example, it includes provisions establishing that administrative and operational performance targets must include actions related to the promotion of cooperation with competition, consumer, and environmental protection bodies, where applicable (art. 19). Additionally, the law establishes rules for the relationship between competition authorities, consumer protection authorities, and regulators, primarily centered on information sharing and experience exchange (art. 25 and 29).¹¹

The Law of Regulatory Agencies also empowers regulatory agencies to form committees for exchanging experiences and information among themselves or with entities within the Brazilian System for the Defense of Competition (SBDC), including CADE (art. 30). The purpose is to establish shared guidelines and procedures for regulatory activities in their respective areas and sectors, fostering reciprocal consultation when formulating rules impacting the conditions of regulated sectors. Additionally, regulatory agencies have the authority to collaborate with bodies and entities within the National Consumer Protection System (SNDC), including SENACON, and can enter into cooperation agreements with SNDC entities. Regulatory agencies share with the SNDC the responsibility for ensuring compliance with consumer protection legislation and are responsible for monitoring and overseeing the market practices of agents in their regulated sector (art. 31). The underlying premise is that competition and consumer protection are cross-sectoral policy areas that should be promoted not only by specialized bodies with these mandates but also by regulators across various sectors.

In addition, formal bilateral cooperation agreements among the four organizations involved in the WhatsApp case had already been established, as detailed in Table 1 below. However, the terms of these agreements were generic, and at the time of the case, did not include specific terms related to the cross-sectoral nature of digital platforms or cooperation in that specific space.

Table 1. Technical agreements between the four organizations that engaged in the WhatsApp case.

PARTIES	COOPERATION AGREEMENT
CADE-SENACON	Technical Cooperation Agreement SENACON/CADE (signed on 18 July 2012)^32
SENACON-MPF	Technical Cooperation Agreement SENACON/MPF (from March 2015)^33
	Technical Cooperation Agreement No. 1/2021/CIHP/CGSINDEC/DPDC/SENACON (signed on 13 June 2022),^34 although this was signed after the WhatsApp case and focused on cooperation around the e-government platform consumidor.gov.br
CADE-MPF	Technical Cooperation Agreement No. 1/2020 CADE/MPF (signed on 5 February 2020)^35
ANPD-SENACON	Technical Cooperation Agreement No. 1/2021/GAB-SENACON/SENACON (signed on 22 March 2021)^36
ANPD-CADE	Technical Cooperation Agreement No. 5/2021(signed on 2 June 2021)^37

Source: The author, based on publicly available information.

Moreover, there are institutional channels and procedures established to mediate conflicts between public bodies in Brazil, although there is no evidence that they had been used to address any digital platform-related dispute at the time of writing. Specifically, the Federal Administration Mediation and Conciliation Chamber (CCAF) was established by the Attorney General’s Office (AGU) in 2007 to resolve conflicts of competence between federal public bodies, as per Statutory Act (Ato Regimental) No. 5 and Regulation (Portaria) No. 1,281/2007. Using self-composition methods, the CCAF/AGU facilitates mediation procedures with the aim of preventing and resolving consensually conflicts that may arise among federal public bodies, agencies, and federal public foundations. Crucially, the chamber does not make decisions on behalf of stakeholders; instead, it assists them in the decision-making process by offering negotiated solutions in situations of conflict.¹²

In summary, the regulation of digital platforms in Brazil, given their cross-sectoral nature, does not fall under the jurisdiction of a single regulator. Instead, multiple public bodies hold mandates to regulate and supervise issues pertaining to digital platforms. While formal channels for cooperation among ANPD, CADE, MPF, and SENACON existed before the WhatsApp case,¹³ they were primarily procedural and not designed to guide extensive inter-agency coordination.

3. Measurements of governance and their relationship with digital platform regulation

In addition to formal mechanisms for cooperation, broader institutional factors also shape the interactions between public organizations. Public administration literature emphasizes that for government agencies to cooperate effectively and achieve their objectives, they must embody the key features of good governance. Governance, broadly defined, encompasses the ‘institutional process of building political and administrative authority, defining who governs, under what conditions and with the duty of accountability to society’ (Filgueiras 2019). The traditional governance agenda has been criticized for reflecting historical power imbalances between Global North and Global South and imposing neoliberal perspectives on developing countries (Frey 2008; Grindle 2004). However, more recent studies have provided a more nuanced perspectives on the analytical power of governance indicators (for example, Andrews 2008). Informed by empirical evidence, including studies on the Brazilian case (for example, Bersch 2016; Taylor 2020), these perspectives offer new insights for examining the relationship between good governance, institutions, and development, and justify the use of measurements of governance as a lens to examine relationships between public agencies in the present study.

3.1. Capacity and autonomy

Political science scholars have identified two important dimensions of good governance: capacity (referring to resources and professionalization) and autonomy (the independence of bureaucrats from political principals and industry interests).¹⁴ Despite valid criticisms regarding the challenges of measuring and interpreting governance indicators, they provide valuable starting points to understand the ‘political foundations of development’ (Dellepiane-Avellaneda 2010). The concepts of capacity and autonomy, therefore, inform the theoretical framework adopted in this study and serve as analytical lenses to examine the drivers and obstacles to inter-agency coordination.

In the social sciences literature, state capacity includes having professionalized bureaucracies and effective inter- and intra-government management mechanisms. The existence of expert career paths and coherence within agencies are key elements that contribute to enhancing performance.¹⁵ In the Brazilian context, capacity within federal agencies is also impacted by the proportion of civil servants in expert careers, career longevity, staff requisitioned from other agencies, and average salaries (Bersch et al. 2017). In this sense, capacity can also be evaluated based on the extent to which an institution can fully implement the law and the decision-making process involved in the interpretation and application of legal provisions. For instance, in the case of digital platforms, government agencies and regulators need to recruit and retain qualified professionals who understand how digitalization strains traditional legal frameworks and how to regulate innovative industries.

The dimension of autonomy refers to the independence of bureaucrats from political principals and industry interests. In the Brazilian context, Bersch et al find that autonomy is a crucial factor in improving governance and policy implementation, defining it as the degree of insulation of civil servants from political intervention in agency decision-making (Bersch et al. 2017).¹⁶ Autonomy can be examined from both political and regulatory perspectives. Politically, autonomy is often associated with control and supervision over institutional resources, such as budget and personnel, while maintaining separation from other organizations, including the interference of elected politicians in the bureaucracy.¹⁷ In this sense, the measurement of autonomy also incorporates data related to the available budget of the institution, the legal framing of the institution, and the powers legally attributed to it (Geddes 1990).

From the regulatory perspective, autonomy can be associated with resilience against business capture, or regulatory capture. That is, the regulators’ ability to counter the disproportional influence of powerful economic agencies in the design of regulation.¹⁸ Simply put, the theory of regulatory capture proposes that regulated industries – especially in the existence of monopolies or in sectors dominated by few, large economic agents – would have incentives to seek regulatory protections and to influence the regulator, in order to capture ‘regulatory rents’. The regulator, in turn, would be more likely to side with industries’ high, concentrated interests, rather than regulate in benefit of more diffuse interests, such as those of the public or ‘citizens at large’. While the idea of regulatory capture has been subjected to questions from several fronts as the literature on regulation and public policy evolved,¹⁹ it has contributed to the understanding of how regulation is shaped by emphasizing the relationship between multiple interest groups and between these interests and the state. Importantly, this notion of capture also paved the way to fundamental debates about the role played by institutional design in regulatory processes, and to efforts to design institutional arrangements that incorporate mechanisms to reduce the possibility of capture. For example, the literature has pointed out that developing cross-sector agencies that oversee different industries could make the regulator less vulnerable to the grip of any one single industry (Baldwin, Cave, and Lodge 2011).

3.2. Inter-agency coordination

Another fundamental concept for understanding the WhatsApp case, closely linked to capacity and autonomy, is coordination. In the social sciences literature, coordination can be understood both as a process and an outcome. As a process, it refers to the means through which decisions are brought together by different government organizations. As an outcome, it measures the level of policy coherence that can be achieved through the interaction of government programs and organizations (Bouckaert, Peters, and Verhoest 2010).²⁰

The literature also classifies coordination as being negative or positive. On the one hand, negative coordination is the basic level of coordination, one in which there is an agreement (tacit or explicit) between organizations that they would not interfere in each other’s policy agendas, reducing the likelihood of conflict between them. Positive coordination, on the other hand, requires organizations and actors to take positive steps to consider and engage with the agenda of other actors and organizations, and can often require some level of compromise between them in order to achieve a greater goal (Bouckaert, Peters, and Verhoest 2010). This type of positive coordination is, therefore, particularly relevant in addressing cross-sectoral policy issues, such as those related to data and digital platforms.

Effective coordination is essential within functional bureaucracies. Bouckaert et al. argue that both the underlying and resulting problems of lack of coordination are linked to a loss of government policy capacity (Bouckaert, Peters, and Verhoest 2010, p. 12). In other words, when government organizations fail to coordinate, it not only indicates problems in their decision-making processes but also leads to worse policy decisions. In contrast, greater levels of coordination can lead to better policy outcomes – including more coherence and less redundancy and contradictions within and between policies, and less conflict between government agencies.

The WhatsApp case, therefore, serves as a case study in coordination, providing an opportunity to examine the formal and informal mechanisms for coordination, how it unfolded on the ground, and the outcomes of the agencies’ joint effort. In addition, it is also a case of capacity and autonomy, as the presence of professionalized bureaucracies and the independence of bureaucrats are factors that contribute to understanding not only the internal workings of each agency but, crucially, the incentives and challenges that affect the ability of government bodies to interact with each other.

4. Background: the legal issues in the WhatsApp case

Against the institutional backdrop discussed in section 2, the quartet – ANPD, CADE, MPF, and SENACON –, began working together to examine the legal issues related to the WhatsApp case. This marked the first instance of a coordinated regulatory effort at such a scale involving the regulation of digital platforms in Brazil. Before examining how these four bodies worked together, it is worth examining what they were examining; that is, the substantive legal issues raised by the WhatsApp case.

4.1. Setting the scene: legal issues in the WhatsApp case

On 4 January 2021, WhatsApp announced changes to its terms of service, providing more details about its existing data processing practices. These changes also introduced provisions for data processing allowing sharing with Facebook through a new WhatsApp Business service designed for message hosting and managing user-business communications.

Shortly thereafter, on 8 January 2021, ANPD sent requests for information to WhatsApp and Facebook regarding their data processing activities. ANPD issued Technical Note No. 02/2021/CGTP/ANPD following its preliminary assessment of the terms of service changes on 22 March 2021.²¹ This note recommended the preparation of an impact report by WhatsApp to assess the integration of WhatsApp and WhatsApp Business, identifying associated risks in data processing. The note also recommended amendments to WhatsApp’s privacy policy to enhance transparency regarding the legal basis and purposes of data processing, details on how data subjects can exercise their rights, and disclosure of any unintentional processing of sensitive data or data from minors. In addition, it recommended strengthening safety and security measures, including the adoption of data deletion protocols, provision of data management tools, and implementation of privacy by design and default features.

On 31 March 2021, IDEC sent to ANPD, the MPF office at CADE, and SENACON a letter raising concerns about compliance with the LGPD and consumer protection legislation. The letter questioned WhatsApp’s data governance practices, emphasizing the implications of data sharing between WhatsApp and Facebook²² – a concern dating back to Facebook’s acquisition of WhatsApp in 2014.²³ Specifically, the letter raised three main substantive issues. Firstly, IDEC argued that the changes violated consumer protection legislation and the Brazilian Internet Civil Rights Framework (Marco Civil da Internet, Law No 12.965/2014) as WhatsApp did not seek informed consent from users or provide them with the right to opt out. Secondly, and relatedly, IDEC raised concerns with transparency, noting that the company did not provide clear, detailed information about the types of data being shared with Facebook, how Facebook would process the data, or the legal basis for the data processing. Thirdly, the letter mentioned concerns related to the market power of Facebook and WhatsApp, emphasizing that due to the companies’ dominant position, users might not have alternative services to choose from if they disagree with the terms of service. IDEC also pointed out that the way the companies collect, integrate, and process user data could potentially constitute an abuse of dominant position.

The first joint statement issued by ANPD, CADE, MPF, and SENACON reflected some of these concerns, pinpointing specific legal provisions in several federal laws that could have been impacted by WhatsApp’s new policy – these included the Federal Constitution of 1988, consumer protection legislation, data protection law, the MCI, and competition law. Based on this preliminary assessment, the quartet issued the following recommendations to WhatsApp: (i) delaying the implementation of the new terms of service pending regulatory analysis, (ii) refraining from restricting user access to its services, and (iii) adopting measures outlined by ANPD in Technical Note No. 02/2021/CGTP/ANPD, including impact assessment, transparency, and safety measures.²⁴ Additionally, the joint document recommended that Facebook abstain from processing data collected by WhatsApp until the regulatory bodies had reached a decision on the matter.²⁵

4.2. The outcomes of the coordination: conclusions and recommendations

Following the issuance of the first joint statement, it was agreed among the quartet members that ANPD would lead the substantive investigations. This involved a series of meetings with the companies, the production of analyses and technical notes, and spearheading engagement with the other quartet members. The process concluded with ANPD wrapping up technical work after twelve months, in May 2022, and publishing Technical Note 49/2022/CGF/ANPD, with a summary of its main findings. The four bodies then met for a final meeting on 22 May 2022, and published minutes summarizing their final joint assessment of the case. In these minutes, each body outlined their main conclusions and action points – which presented variation.²⁶

From ANPD’s perspective, all recommendations from its first technical note (02/2021/CGTP/ANPD) and from the first joint statement had been eventually implemented by WhatsApp and Facebook. However, the regulator identified additional issues not addressed in the scope of the investigation and concluded that it was necessary to initiate a separate investigation, focusing specifically on the sharing of data between WhatsApp and Facebook.²⁷

Both CADE and SENACON similarly concluded that all recommendations were observed and met by WhatsApp. SENACON argued that the items of the joint recommendation as well as the requests issued by ANPD, were satisfactorily addressed by WhatsApp and considered it unnecessary to take any additional measures. From a competition perspective, based on the relevant provisions of the Brazilian competition law (Law No. 12,529/2011), CADE also agreed that no additional measures were necessary. However, CADE noted that ANPD’s decision to conduct a separate investigation into the sharing of personal data between WhatsApp and Facebook would not preclude potential future investigations by CADE related to violations against the economic order, should evidence of such issues emerge.

Taking a different position from the other agencies, MPF refrained from fully endorsing ANPD’s analysis in Technical Note 49/2022/CGF/ANPD and highlighted relevant divergences in their conclusions. Instead, MPF decided to conduct its own separate investigation on various issues where it considered further analysis was necessary or where its perspectives diverged from ANPD. One significant concern revolved around transparency in WhatsApp’s privacy policy and data processing. MPF found ANPD’s analysis, which primarily focused on LGPD compliance, to be insufficient and argued that other relevant legal provisions, includingfrom the MCI and the Consumer Protection Code, needed consideration. Furthermore, MPF believed that further adjustments by the app would be necessary to further enhance transparency and users’ access to privacy policies. These included consolidating the privacy policy into a single document, indicating internal control numbers and dates, numbering paragraphs for easier reference, and providing a shortcut for printing essential documents in PDF or another digital format.

Another significant area of disagreement pertained to ANPD’s interpretation of legitimate interest in the case. Unlike ANPD’s interpretation, MPF was not convinced that legitimate interest would serve as the legal basis for all activities conducted by WhatsApp. MPF argued that data authorities in other jurisdictions, including in Italy, Spain, and Germany, which had examined the same WhatsApp privacy policy, considered it necessary to also assess consent and whether it had been informed or coerced. Crucially, MPF argued that further investigations were necessary to determine whether the activities authorized by ANPD under legitimate interest legal basis would indeed meet the LGPD threshold of being ‘strictly necessary’.

Regarding the sharing of data between WhatsApp and Facebook, MPF stated that it would conduct its own investigation on the issue, acknowledging that ANPD would also separately investigate this matter. While the possibility of collaboration was open, ANPD and MPF would conduct their investigations independently. Furthermore, MPF highlighted several other points of disagreement with ANPD’s specific interpretations and mentioned its intention to further investigate issues such as the transparency and simplicity of tools available to users to exercise their rights, including data deletion; the necessity for WhatsApp to appoint a data protection officer, and the measures to protect children and teenagers.

Based on the conclusions and action points identified by each agency in the final joint minutes, two aspects stand out. Firstly, there is evidence that each institution had a different level of involvement in the case. The quartet had agreed that most of the technical work would be conducted by ANPD, which served as the central point of coordination, and this is reflected in the detailed technical analysis prepared by ANPD. In contrast, other bodies, such as CADE, had much less direct involvement and did not provide their own analysis in the final minutes, adhering to ANPD’s technical assessment and offering concise comments.

Secondly, the joint minutes revealed points of contention between ANPD and MPF. MPF’s final conclusions identified several aspects where it believed conducting its own separate investigations would be relevant. This divergence in interpretation may be attributed to the broad mandate of MPF, which encompasses the protection of individual and collective rights and the enforcement of a wide range of federal laws beyond the focus of ANPD. However, it is noteworthy that in several instances the MPF analysis contrasted with or contested ANPD’s interpretation of provisions of the data protection legislation itself.

While the joint minutes offer insights into the topics of disagreement, they do not fully reveal the underlying causes or contexts in which they arose – nor do they explain why such disagreements were not addressed earlier in the joint effort and were only raised in the final minutes. Therefore, analyzing the perspectives from the involved actors regarding how the joing effort unfolded can provide a deeper understanding, including potential issues related to capacity and autonomy that may have influenced the outcomes of their coordination.

5. Coordination on the ground: findings from the analysis of the Whatsapp case

Examining the WhatsApp case requires a deeper look beyond the insights provided by the technical notes and joint documents published by the authorities. To understand how inter-agency coordination unfolded, including where issues related to capacity and autonomy might have affected the outcomes discussed in the previous section, this section draws from interviews with key stakeholders. Through qualitative analysis of the interview transcripts, it identifies and explores the motivations and constraints that influenced the interactions between ANPD, CADE, MPF, and SENACON, providing context for understanding this case of inter-agency coordination.

5.1. From cooperation to coordination: the drivers of the WhatsApp case

The WhatsApp case illustrates how public bodies overseeing digital platforms came together to collectively examine the legal implications of the app’s terms of service changes. From the perspective of the participants, despite the cross-cutting nature of the issues, this movement towards coordination was considered an exceptional case in the Brazilan context. As another interviewee noted:

Looking specifically at digital markets, in general, the problem of better coordination between different public policies is a deficiency in the state of Brazil. (…) There is a very big deficiency in coordination between different agendas and different policies public (interviewee 2)

The joint effort in the WhatsApp case was not necessarily initiated through formal channels of cooperation, and there was no centralized decision to initiate cooperation at the level that occurred. Instead, the research reveals a unique combination of factors that contributed to the collaborative approach taken by the involved bodies, particularly the strong relationships among key personnel working across the four institutions. In the words of two interviewees:

In the WhatsApp case … it was something that emerged a little informally from the good relations that had already been established between SENACON members and ANPD members. We scheduled a meeting, then at that point the person from CADE also called us and they already had a contact with the MPF. And we decided to get everyone together, let’s try to cooperate (interviewee 7)

IDEC filed a petition against WhatsApp … and mentioned that it had petitioned all these bodies. The bodies decided to talk, but it was something like this: ‘yeah, let’s divide some tasks, what do you think about proposing joint recommendations?’ (interviewee 1)

The informal nature of the initial contact and the engagement between agencies highlights the significance of personal connections and social capital in facilitating inter-agency coordination. As one interviewee pointed out, ‘cooperation agreements are a necessary condition, but not sufficient for cooperation to actually happen’ (interviewee 7). In the words of another interviewee: ‘[T]he WhatsApp case happened because of the people who were in the four places’ (interviewee 6). Additionally, technical cooperation agreements, as discussed in section 2, helped to formalize institutional settings and also facilitated joint work. As one interviewee noted:

‘Cooperation already occurs through cooperation agreements … And these agreements are, I think, meant to institutionalize the channels of conversation, to attempt perhaps some level of coordination in some decisions’ (interviewee 4)

While personal relationships and recognition by agents within each agency that other relevant bodies could be involved may have prompted the initial conversation, they do not entirely explain why the conversation continued and how it evolved. The nature of the issue at hand also played a crucial role in the quartet’s incentives to work together. Specifically, given the circumstances of the case, there were reasons to believe that any remedy or regulatory response could potentially have an impact on more than one policy issue, and the officers working on the case recognized the relevant areas of intersection. The following two quotes illustrate this point, which were provided in response to questions about the reasons behind coordination in the WhatsApp case:

It was the perception of the existence of a real problem, the need for the Brazilian state to respond to this problem, and the realization that it was an issue that was not exclusively in the agenda of any single body … from the perception of the problem, there was an initiative to jointly attack the problem … [it was] the perception of the problem that led one body to reach out to the other to talk and seek a joint solution (interviewee 2)

And what became evident when examining the case in more detail is that the business model was based on sharing data with a view to monetization … the data, in addition to being a projection of the human personality, is a very important economic input, so sharing this personal data between two organizations that are part of the same economic group, but which in theory are separate, ends up giving rise to issues in several areas of law. Not only in the area of personal data protection, but also in the consumer protection sphere and in the competition sphere. And this was a case that ended up giving rise to a very interesting cooperation between different public bodies, it gave rise to coordinated action across the ANPD, the SENACON, the MPF and CADE (interviewee 6)

Additionally, the officials involved recognized the importance of working together to address potential issues that could arise from a lack of coordination. They were acutely aware that failure to coordinate could result in inconsistent decisions, a concern emphasized by interviewees:

Avoiding an understanding that generates contradictory obligations, I think that was the biggest fear. For example, ANPD taking a decision that would be diametrically opposed to that of SENACON or CADE (interviewee 5).

It seems to me nothing more than a matter of common sense. Because a dispute between bodies, whether in terms of interpretation or a dispute for space, it is something that costs a lot, right? … So, imagine if in the concrete case, ANPD says that the correct application of the law to this case is B, and CADE comes and says that it is C. It is something that is bad for everyone. It is bad for the regulated agent, it potentially leads to judicialization, and to a judicial decision that will potentially be worse than the decision taken by the technical bodies. And it is bad for the bodies involved themselves, because instead of focusing on solving the problem, they have to focus on resolving the interpretative dispute at hand. (interviewee 7)

The considerable efforts mobilized and sustained engagement of the bodies in the WhatsApp case were also influenced by other factors, including the urgency of the issue, the desire to demonstrate effective action in a salient topic, and recognition by officials of the public interest at stake. One interviewee explained that:

There was a lot of good will from the four parties, that helped a lot. And there was an interest from all of them to stand out in this field, to show that they were acting, even more so because I think it was the first big case involving big techs … I think that a lot came from this desire to be engaged in the theme that was the issue of the moment (interviewee 5)

The progression towards substantive coordination, stemming from the officers’ recognition of the relevant areas of interaction in their work, was preceded by a desire to cooperate – a desire formalized through technical agreements. Therefore, the existence of these agreements served not only as a formal instrument for cooperation but also as an expression of the organizations’ willingness to work together, as acknowledged by individuals in positions of power who understand the significance of inter-institutional interactions.

The ANPD-SENACON agreement exemplifies this argument. Even before the WhatsApp case, negotiations were underway for a technical cooperation agreement – which included commitments to sharing documents, information, and experiences, as well as promoting meetings, training courses, and events for civil servants from both agencies. As one interviewee noted: ‘The agreement with SENACON came out even before the WhatsApp case … In the case of WhatsApp, conversations began at some point, and there was already this cooperation agreement in place with SENACON’ (interviewee 5). This agreement itself stemmed from recognizing the overlap between the organizations’ mandates. Hence, the agreement was not only an expression of the agencies’ willingness to collaborate but also a formal avenue that helped facilitate substantive coordination in the WhatsApp case. In the words of another interviewee, ‘[the WhatsApp case] was the result of a desire for cooperation that already existed before’ (interviewee 7).

Other organizations have acknowledged the necessity of formalizing agreements and establishing structured mechanisms to facilitate coordinated efforts in the future, following their experience with the WhatsApp case. From this perspective, the coordination observed during the case can also be viewed as an initial step towards more tangible forms of cooperation, potentially leading to the development of a technical agreement:

We have really sought to formalize these cooperation mechanisms through technical cooperation agreements precisely because we recognized the trend that these cases [involving digital platforms] will not be limited to a single legal tool, that they will not be limited to data protection, but will certainly have repercussions in other legal fields. This coordinated action seems to be essential so we can have legal certainty (interviewee 6)

These alternative approaches to engagement underscore that the formal institutional framework, which governs the relationship between organizations, represents just one piece of the puzzle in understanding why and how public bodies coordinate their actions. As revealed in the interviews, the drivers behind the initial contact among the four organizations and the subsequent coordination during the WhatsApp case are more complex, involving both formal and informal institutional dynamics.

5.2. Capacity and autonomy constraints and their effects on inter-agency coordination

The ANPD’s characteristics played a pivotal role in comprehending the interactions among various entities during the WhatsApp case. Its lean structure at the time was a result of political and economic decisions made during the passage of Brazil’s data protection law and the establishment of the data protection authority. These decisions were driven by concerns about the high costs associated with creating and staffing a new agency. As a result, the ANPD was initially established as a resource-constrained entity under the office of the presidency, rather than as an autonomous agency. However, this design limited the ANPD’s ability to enforce the new legislation and was identified by interviewees as an issue that affected the fulfillment of the agency’s main policy objectives during the coordinated efforts. As noted by one interviewee:

The data protection agency with the mandate it has … it needs resources to carry out this agenda. And what I mean is more people, more staff positions, enough for you to run the agency … but the ANPD was created with 30 members of staff … The people who are now at the ANPD are extremely competent and are establishing work processes well. But with 30 staff members you will only be able to implement 10% of the ANPD’s ideal agenda … we are living in a context of scarce resources from the Brazilian State, both financial and human. That means we don’t have enough budget and not enough people (interviewee 2)

The mismatch between the limited capacity conferred to the ANPD and the scope and complexity of the legislation it had to enforce was especially stark in a country like Brazil, where the data protection culture was still nascent:

Brazil, in a way, imported one [from the EU] or was inspired by a modern and advanced legislation for the protection of personal data without previously having had a culture [of that protection], in short, without having a greater systemic and academic development on the subject (interviewee 7)

Additionally, ANPD’s limited capacity and autonomy provided strong reasons for the agency to collaborate with other bodies and to actively pursue cooperation agreements with other agencies. While these constraints might make it difficult for the ANPD to fully carry out its tasks and work effectively with others, interviewees suggested that they could have actually encouraged cooperation as a solution to overcome these limitations:

The ANPD (…) in a way, an organization created late, although with a central role in the interpretation of the legislation, it really needed to seek these alignments to avoid being, in a way, submerged by other initiatives that were already underway. So, in a very practical way (…) the ANPD needed to insert itself in this chessboard, occupy this space and establish these relationships so that its vision could also be considered and heard in a constructive way in the many cases that we imagined would attract the attention of these actors (interviewee 7)

Moreover, the joint work of the organizations during the WhatsApp case revealed challenges that went beyond the specific constraints faced by the ANPD. Another capacity-related aspect highlighted in the interviews, arguably applicable to all public organizations, was the preparedness of officials to identify and design responses to issues related to digital platforms. This skill is crucial for determining appropriate measures, including understanding the limitations and possibilities of existing legal tools, but also for effective collaboration with relevant bodies. During the WhatsApp case, emerging themes surrounding the regulation of digital platforms were just starting to gain recognition as areas of study and practice in Brazil. Consequently, many officials lacked the training to grasp the complexities of these issues or discern their legal implications. As one interviewee emphasized:

The Brazilian institutions are slow in recognizing the illicit practices in digital markets because digital markets are little known in the public sector … I think that in Brazil we have a very long delay in the development of this type of subject in disciplinary terms, to become the object of reflection in universities … For example, when I left university, there wasn’t a digital law course, it was after I left [that it was created] … Courses in digital law, law and technology, etc are not included in the legal curriculum here in Brazil. I think this reflects a lot on the capacity of officials who are in strategic positions of power in these different institutions’ (interviewee 1)

Capacity issues within the ANPD and other involved bodies can help to elucidate why differences in the interpretation of laws and public objectives emerged, became more pronounced as the investigations progressed, and remained unresolved – a point evident from the final minutes, especially regarding disparities between the ANPD and MPF. Capacity constraints, such as variations in investigatory powers and the pace of investigations, were identified by interviewees as barriers that hindered more substantial coordination in terms of outcomes. According to one interviewee, the coordinated effort around the WhatsApp started to slow down at some point due to ‘differences in procedures and priorities of each organization’ (interviewee 1), contributing to discrepancies in the conclusions reached by different bodies.

The lack of complete coordination in the outcome of the WhatsApp case, however, does not indicate a failure of coordination. From the perspective of coordination as a process, the mention in the final minutes of divergences and variations in understanding among the involved bodies could be seen as a positive aspect, as it transparently identifies areas of disagreement and gaps requiring further investigation. This also suggests that during their joint work, each member of the quartet maintained a degree of autonomy and was allowed to pursue their agendas independently when necessary. As the final joint document published by the four organizations noted: ‘the joint action was based in the search for the harmonization of understandings in light of the different possibilities of action, while safeguarding the attributions arising from each entity’s institutional missions’.²⁸ Allowing for disagreement can be viewed as a positive characteristic of the informal arrangements complementing the formal institutions governing the relationship between ANPD, CADE, SENACON, and MPF. As one interviewee pointed out:

Of course, the bodies will adopt some approaches that will generate different obligations. And that actually happened. There was a moment of joint concentration, but then each one created their own administrative process (…) even because it would be the most logical way. The processes are running now, each at their own pace, but I think this initial alignment was more important (interviewee 5)

Overall, the analysis highlights how understanding ANPD’s limited capacity and autonomy at the time sheds light on the coordination process and outcomes of the WhatsApp case. It also underscores the significant impact of institutional design choices made during the policy formulation and legislative debate stage. On one hand, ANPD’s constrained capacity incentivized collaboration with other bodies and prompted the formalization of cooperation agreements. On the other hand, it impacted the pace and resources available for investigations, potentially accounting for disparities in the conclusions presented in the final minutes. However, the fact that members of the quartet could hold differing views is indicative of the flexibility of the arrangement, where institutions were not bound to adopt the interpretations of others. Importantly, in this instance, discrepancies did not lead to directly conflicting outcomes but rather prompted the identification of areas requiring further investigation by specific organizations.

5.3. Potential models for digital platform regulation in Brazil

Examining the WhatsApp case unfolding within Brazil’s current institutional framework reveals limitations affecting the regulation of digital platforms. This prompts consideration of alternative designs to enhance capacity and autonomy within and across the overseeing organizations. This discussion is particularly relevant given recent debates surrounding platform accountability, transparency and content moderation regulation and the appointment of an agency to enforce future legislation in this area. Options include creating a new entity or assigning new responsibilities to an existing organization. Several candidates are being considered for this role, including ANATEL (the communications regulator), CADE, ANPD, the Comptroller General of Brazil (CGU), and the Brazilian Internet Steering Committee (CGI.br). As Brazilian policymakers and regulators actively consider alternative institutional arrangements for digital platform regulation, what lessons could the WhatsApp case provide?

Interviewees reflected on whether having a centralized digital regulator would have yielded better outcomes than the quartet’s efforts in the WhatsApp case. The notion of establishing specialized agencies dedicated to regulating digital platforms implies granting them powers akin to sector regulators, including the establishment and enforcement of ex ante prescriptive rules – thus creating a ‘Digital Regulator’ or a ‘Digital Watchdog’. However, scholars caution that while such an institution could streamline the identification and resolution of issues involving digital platforms, its implementation may be challenging and may not address all institutional concerns associated with digital regulation. For example, Van Loo argues that a central digital regulator requires adequate funding, anti-capture mechanisms, performance metrics, and comprehensive information-collection powers, and warns that it might accumulate excessive power, necessitating the establishment of countervailing and accountability mechanisms (Van Loo 2017). Similar concerns were echoed by interviewees, who highlighted that having multiple institutions, rather than a centralized digital regulator, could help mitigate the risk of regulatory capture:

There is an advantage in this institutional multiplicity (…) the absence of someone who conducts this type of articulation in a preponderant way (…) Other policy areas, such as anti-corruption, reveal the advantage of institutional multiplicity. An advantage is exactly the fact that all of them have attribution together. If one is captured, the other can act. So, you have a very high burden of capturing some institutions in some policies in relation to which there is overlap, and I think this is an advantage (interviewee 1)

Moreover, interviewees have argued that in the Brazilian context, establishing such a central regulator would be politically unlikely and practically unfeasible. Concerns were raised, particularly about implementing inflexible formal rules mandating agency collaboration, which could ultimately hinder the performance of the involved agencies:

A digital regulator that will have powers possibly overlapping with those of other bodies, is capable of disturbing others more than anything else (…) And politically, I don’t see that happening simply because you will be giving up some power, for example access, budget, etc (interviewee 6)

While I think it makes sense to have a body dedicated to trying to bring consistency and coherence to the many initiatives that exist, it does not need to be a body with its own regulatory powers, but perhaps a body to build bridges between these different perspectives that turn to the digital phenomenon (…) So, I think that maybe one more instance of coordination, or maybe an organ would work as a support point, that could help them, bring subsidies. But I don’t see how a new body could replace the performance of the countless bodies that already exist today, that already operate in different segments of the digital sphere (interviewee 7)

Brazil is not the only jurisdiction grappling with the regulation of digital platforms and debating which institutional arrangements should be adopted. The experiences of other jurisdictions facing similar questions could provide valuable insights for the Brazilian debate. Notably, recent legislative developments in Europe, such as the Digital Markets Act (DMA) and the Digital Services Act (DSA), will challenge the existing arrangements developed by the EU over the years. While key provisions of the DMA and DSA will be enforced at the EU level by directorates of the European Commission, others will be enforced at the national level, necessitating coordination not only across sectors but also among member states and between member states and the Commission.

Previous EU experiences, particularly regarding interactions between sector regulators like the European Data Protection Board (EDPB), national competition authorities, and the Commission, have favored more flexible models. For example, while the EU encourages consultation between competition authorities and sector regulators, no formal agreement outlines cooperation protocols (European Union 2022). The establishment of a Digital Clearinghouse in 2017 provides another example. This Clearinghouse was proposed by the EDPB as a network of regulators and authorities responsible for enforcing laws in the digital ecosystem, covering areas such as competition, data protection, consumer protection, and electoral regulations. Unlike a central regulator or ad hoc coordination efforts, the EU Digital Clearinghouse functioned as a forum to ‘share information and discuss how best to enforce rules in the interests of the individual’.²⁹ However, after biannual meetings from 2017 to 2020, there is no record of meetings having been held in recent years, or what the expected impact of the DSA and the DMA coming into force is likely to be.

The UK is another jurisdiction that has been exploring new approaches to enforce digital platform regulations. Notably, the country is experimenting with the establishment of the UK’s Digital Regulation Cooperation Forum (DRCF), which brings together the Competition and Markets Authority (CMA), the Information Commissioner’s Office (ICO), the communications regulator (Ofcom), and more recently the Financial Conduct Authority (FCA) to support regulatory coordination in digital markets. The DRCF was established based on the understanding that the regulation of digital platforms brings unique challenges that require even deeper regulatory coordination.³⁰ While the DRCF does not have enforcement power or the ability to issue guidance on resolving potential conflicts, it seeks to enhance regulatory capacity by pooling knowledge and resources from multiple organizations, such as through the conduction of joint investigations and research (Vanberg 2023).

Interviewees in Brazil expressed openness to lighter, more flexible approaches to digital coordination, akin to the models experimented with in the EU and the UK. They stressed the importance of avoiding overly formal or prescriptive structures that mandate specific outcomes, allowing for flexibility and exit points. According to the interviewees, while cooperation and information-sharing are desirable, imposing formal, rigid rules for coordination between agencies could hinder collaboration and result in agencies pursuing different objectives at varying speeds. As one interviewee put it:

I think there is a lot of cooperation missing. Brazil has to be encouraged to do this, it has to have a team doing this … But that cannot be compulsory. It cannot be something that comes at the expense of the independence of the bodies involved. It has to be something that has to be thought of in terms of results, of legal certainty, but not in terms of an absolute guarantee that everyone will relinquish power in order to work together (interviewee 1)

There was agreement among interviewees that introducing more procedural rules could incentivize coordination and facilitate effective communication channels between agencies. This might entail implementing duties to consult, formalized mechanisms for sharing information, and clear procedures for initiating discussions. Specifically, interviewees underscored the importance of fostering a culture of collaboration and active engagement among various public bodies. They emphasized that while formal institutions are valuable, it is equally crucial to cultivate a mindset of working together within the organizations themselves, ensuring that coordination is not solely reliant on personal relationships:

It is important that there is also the construction of a relationship of trust between the members of the organizations, so that it is almost instinctive to pick up the phone and call the partner at the other body. Saying ‘look, there’s a case here, it would be interesting for you to take a look, what do you think’, you know? So, I think there is still a bit of institutional maturity that we need to have in Brazil (interviewee 7)

From the moment that joint action becomes natural and as we have examples of success, success in coordinated action, the instrument starts to be used more frequently, preventing friction (interviewee 2)

Overall, the findings suggest that there is little support among current regulators in Brazil for establishing a central digital regulator. This reluctance is unsurprising, as it would entail sharing or relinquishing power to a new entity. However, there is openness to enhancing existing institutional frameworks for digital regulation through more flexible arrangements, potentially informed by the experiences of the EU and the UK. While personal connections and trust relationships remain important, interviewees indicated that clearer procedural rules, without mandating specific outcomes, can create stronger incentives for coordination. This approach could help to address issues of capacity and autonomy within the current framework and mitigate potential challenges associated with establishing a new central regulator.

6. Conclusion

After over a year of joint efforts, involving iterative engagements with WhatsApp and Facebook, the quartet of public bodies – ANPD, CADE, SENACON, and MPF – concluded their coordination with the publication of a document co-signed by them on May 23, 2022. This document delineated their final positions within their respective mandates. While the coordination effort as a whole was deemed successful, as affirmed by the acknowledgment in the joint document that it ‘inaugurated an experience of joint inter-institutional action by the quartet on the subject of privacy and personal data protection, which can be replicated in new cases, taking advantage of the lessons learned in the course of this joint action’,³¹ it also revealed areas of disagreement in interpretations and subsequent actions, notably between MPF and ANPD.

By examining both public documents and interviews with stakeholders from the relevant organizations, this study shed light on how the case unfolded, identifying the driving factors and challenges faced during the coordination process. Through the autonomy and capacity framework, it offered insights into the distinct aspects of the case and its ramifications for future digital regulation in Brazil.

First, the WhatsApp case revealed the importance of establishing clearer procedures and a stronger culture of inter-agency coordination. While formal cooperation agreements and informal structures exist, they might not be sufficient to foster substantial coordination in future cases. The study highlighted a heavy reliance on personal relationships among senior staff members in the WhatsApp case, highlighting their crucial role in acknowledging the cross-sectoral nature of the issues and initiating inter-agency coordination. However, despite the value of personal connections and informal arrangements, the absence of a cooperative culture or more formalized procedures among Brazilian agencies suggests that replicating the coordination seen in the WhatsApp case may not be straightforward. Consequently, future cases involving digital platforms might be handled differently.

Secondly, the research highlights the impact of reduced capacity and autonomy within crucial institutions involved in the coordination process. Specifically, the ANPD’s unique status at the time of the case, established as a body under the Presidency, and its constraints in autonomy and capacity, limited its performance. Collaborating with other agencies likely helped ANPD mitigate some of these constraints, but its lean organizational structure may have hindered its ability to match the pace of more established agencies, affecting the effectiveness of coordination efforts. Therefore, capacity and autonomy building are critical factors to consider for fostering more effective inter-agency coordination in digital regulation in the future.

Finally, the study underscores the need for further research to determine the optimal design of coordination structures and assess the advantages and disadvantages of alternative institutional arrangements. This assessment should consider not only the capacity and autonomy of existing institutions but also those of any potential new regulator. As the ANPD gains experience and institutional strength in regulating the digital ecosystem, and as complex issues related to digital platforms persist, such as debates around platform transparency and responsibility, the dynamics between federal agencies deserve continued scrutiny. The study indicates that while establishing a centralized digital regulator may face political and budgetary obstacles, implementing procedural rules through a coordination infrastructure could facilitate inter-agency relationships. In addition, more flexible arrangements that incentivize coordination without mandating specific outcomes – including, for example, duties to consult, formalized mechanisms for sharing information, and clear procedures for initiating discussions – may find greater acceptance in Brazil.

These findings, while rooted in evidence from the Brazilian case, could have relevance beyond the Brazilian context. As digital platforms operate in many countries, other jurisdictions face similar challenges in coordinating efforts among agencies to address issues related to their regulation. Therefore, lessons learned from Brazil’s experience could inform strategies for enhancing inter-agency coordination in other contexts, particularly in jurisdictions facing similar governance constraints.

Acknowledgement

For helpful comments and suggestions, I am grateful to Nicolo Zingales, Anna Petherick, Miriam Wimmer, Filipe Recch, Lia Pessoa, João Pedro Caleiro, and Lucilla Dias. Any errors remain my own. I am also grateful to the interviewees, without whom this research would not have been possible. This research has been reviewed by, and received ethics clearance through, the University of Oxford Central University Research Ethics Committee (Reference number: SSH/BSG_C1A-21-02).

Disclosure statement

No potential conflict of interest was reported by the author(s).

Additional information

Funding

This research was conducted with support from the John Fell Fund and the Lemann Foundation Programme at the Blavatnik School of Government, University of Oxford.

Notes

1 The modifications to the company's terms mainly concerned the clarification of data processing activities that were already being performed, disclosure of data collection and sharing practices for newly introduced services, and the introduction of new hosting and management services for communication between WhatsApp Business users and companies. Despite some speculation that the revised terms would mean that WhatsApp would be able to start to share data with Facebook, such data sharing had already been taking place since 2016 following a prior revision to WhatsApp's terms of use. See https://faq.whatsapp.com/1182985198951186/?helpref=uf_share (accessed 3 May 2023).

2 In response to the backlash, WhatsApp issued communications reassuring users that their personal conversations were still protected by end-to-end encryption and clarifying that neither WhatsApp nor Meta could read or listen to their personal communications. See https://faq.whatsapp.com/595724415641642/?helpref=uf_share (accessed 3 May 2023).

3 According to Statista data, Brazil had 146.62 million users in 2021. See https://www.statista.com/forecasts/1145210/whatsapp-users-in-brazil (accessed 4 February 2024). As of 2023, WhatsApp’s data places the country as the third-largest globally in terms of app users, following India and Indonesia. Brazil leads in the number of audio messages sent, four times more than any other country, and also tops the rank in sending the largest number of text messages and disappearing conversations (Mello 2023).

4 Letter Coex No. 80/2021, 31 March 2021 [hereinafter IDEC’s letter]. Available at https://idec.org.br/sites/default/files/doc2_whatsapp.pdf (accessed 8 February 2024).

5 Recommendations signed by MPF, SENACON, CADE and ANPD on 7 May 2021 [hereinafter Joint Recommendations]. Available at https://www.gov.br/anpd/pt-br/assuntos/noticias/inclusao-de-arquivos-para-link-nas-noticias/recomendacao_whatsapp_-_assinada.pdf (accessed 8 February 2024).

6 Joint Minutes, Ata n° 008/2022/AC/3CCR/MPF, published on 23 May 2022, available on http://www.mpf.mp.br/pgr/documentos/AtaConjunta.pdf (accessed 3 May 2023) [hereinafter Joint Minutes].

7 The Brazilian National Data Protection Authority was first created in 2020 through the Decree 10474/2020 as the body responsible for implementing and enforcing the Brazilian Data Protection Law (Law 13709/2018 – LGPD). Because of budgetary restrictions and political disputes involving the adoption of the law, the ANPD was not created as an independent agency but as a body of the federal government attached to the Presidency.

8 In June 2022, through Provisional Measure 1124/2022, President Jair Bolsonaro changed the legal status of the Data Protection Authority, turning it into an agency (autarquia de natureza especial), independent from the Presidency. A Provisional Measure (Medida Provisória, or MP, in Portuguese) is a legal instrument, established in article 62 of the Brazilian Federal Constitution, that only the President can enact. It has the effect of law from the day of its enactment but, as the name suggests, it has an impermanent nature and requires subsequent Congress approval to be converted into law. As a rule, the measure is initially valid for 60 days, but this period can be extended for another 60 days. During this period, the content of the MP has to be reviewed and voted in both houses of the Brazilian Congress as a priority item in the agenda, following an expedited legislative procedure. During this process, legislators can amend the text of the MP, which will then be sent to the President who will sign it into law. See https://www2.camara.leg.br/comunicacao/assessoria-de-imprensa/guia-para-jornalistas/medida-provisoria (accessed 3 May 2023).

9 This research has been reviewed by, and received ethics clearance through, the University of Oxford Central University Research Ethics Committee (Reference number: SSH/BSG_C1A-21-02).

10 For a detailed analysis of the complexities involved in the enforcement of the Brazilian data protection law, taking into consideration the pluralistic legal and institutional environment in Brazil, see Wimmer (2021).

11 Article 25 emphasizes that regulatory agencies and competition defense bodies must act in close cooperation, favoring the exchange of experiences, to promote competition and effective implementation of competition protection legislation in regulated markets. Article 29 allows two or more regulatory agencies to issue joint normative acts regarding matters that involve economic agents subject to more than one sectoral regulation. These joint normative acts must be approved by the board of directors or by the collegiate board of each regulatory agency involved, and must contain rules on the supervision of their execution and mechanisms for dispute resolution.

12 Decree No. 11,328 of January 1, 2023, which provides that:

Art. 28. It is incumbent upon the General Consultancy of the Union to:

(…)

VI – promote, through conciliation, mediation and other techniques of self-composition, the solution of conflicts, judicialized or not, of interest to the federal public administration, including those involving States, Municipalities, Federal District and individuals.

Art. 41 states that the Mediation and Conciliation Chamber of the Federal Public Administration is responsible for:

(…)

III – resolving disputes through mediation:

a) between federal public bodies, between federal public entities, or between a federal public body and entity (…)

13 See Boliari and Topyan for a discussion of formal and informal institutions and organizations, drawing on the concepts first proposed by Douglas North (Boliari and Topyan 2011).

14 One example of such an approach is Fukuyama’s dual-framework. Fukuyama argues that effective governance institutions are endowed with two key features: capacity, conceived of as resources and professionalization, and autonomy, the independence of bureaucrats from political principals (Fukuyama 2013). Similarly, Pires and Gomide emphasized the importance of governing arrangements that support the implementation of federal public policies in Brazil, evaluating their technical-administrative and political-relational state capacities (Pires and Gomide 2016).

15 See, for example, the study conducted by Evans and Rauch, proposing a measure of Weberian bureaucracy that incorporates these elements and show that effective bureaucracies are positively associated with meritocratic recruitment and the offer of predictable, rewarding, long-term careers in the civil service (Evans and Rauch 1999).

16 The authors examine how these two variables interact with a third variable: the political dominance of individual parties within each agency. These dimensions of governance are important because they are found to influence corruption. For example, low capacity and low autonomy are associated with higher corruption (Bersch et al. 2017).

17 It is important to acknowledge that the component variables of each of the two dimensions – capacity and autonomy – are also related. For example, institutions with higher relative budgets are arguably more likely to develop higher capacity, by increasing their abilities of hiring more expert bureaucrats.

18 In general terms, regulatory capture is associated with orthodox accounts of the economic theory of regulation, which challenges the idea that regulation is primarily designed to protect and advance some notion of the public interest. According to Stigler, regulation would be ‘acquired by the industry and is designed and operated primarily for its benefit’ (Stigler 1971).

19 See Baldwin et al for a summary of the criticism directed to the theory of regulatory capture and alternative accounts proposed by the literature (Baldwin, Cave, and Lodge 2011).

20 In this article, the analysis of the WhatsApp case in Brazil is centered around horizontal coordination, which pertains to organizations within the national federal level.

21 Technical Note No. 02/2021/CGTP/ANPD, 22 March 2021, available at https://www.gov.br/anpd/pt-br/assuntos/noticias/inclusao-de-arquivos-para-link-nas-noticias/NOTATECNICADACGTP.pdf (accessed 8 February 2024).

22 IDEC’s letter.

23 Facebook’s acquisition of WhatsApp had prompted regulatory scrutiny, particularly in Europe, and raised concerns about how the transaction would affect the collection and use of user data by both companies. Facebook had assured regulators that it would not alter WhatsApp's practices regarding data collection and use. This assurance played a role in the European Commission's approval of the merger, as it was understood that the ‘transaction would not impact the type of data that WhatsApp collects and stores’ (European Commission Case No COMP/M.7217 – FACEBOOK/ WHATSAPP, Paragraph 182, 3 October 2014).

24 Joint Recommendations.

25 Joint Recommendations.

26 Joint Minutes.

27 Joint Minutes, item. 4.1.

28 Joint Minutes, para.4.3.5.

29 See https://edps.europa.eu/data-protection/our-work/subjects/big-data-digital-clearinghouse_en (accessed 10 February 2024).

30 See https://www.drcf.org.uk/home (accessed 10 February 2024).

31 Joint Minutes, para. 4.3.2.

32 Available at https://www.gov.br/mj/pt-br/assuntos/seus-direitos/consumidor/defesadoconsumidor/Biblioteca/acordos-de-cooperacao-upload/acordocooperacaocade08012007403_2012_02.pdf (accessed 3 May 2023).

33 Available at https://www.mpf.mp.br/atuacao-tematica/ccr3/documentos-e-publicacoes/acordos-e-convenios/Senacon.pdf (accessed 3 May 2023).

34 Available at https://www.gov.br/mj/pt-br/assuntos/seus-direitos/consumidor/defesadoconsumidor/Biblioteca/acordos-de-cooperacao-upload/acordos-de-cooperacao-tecnica-cgsindec/acordo-de-cooperacao-tecnica-no-1-2021-cihp-cgsindec-dpdc-senacon (accessed 3 May 2023).

35 Available at https://cdn.cade.gov.br/Portal/acesso-a-informacao/convenios-e-transferencias/acordos-nacionais/2020/MPF_acordo.pdf (accessed 3 May 2023).

36 Available at https://www.gov.br/anpd/pt-br/assuntos/assuntos/noticias/anpd-e-senacon-assinam-acordo-de-cooperacao-tecnica (accessed 3 May 2023).

37 Available at https://www.gov.br/anpd/pt-br/assuntos/assuntos/noticias/anpd-e-cade-assinam-acordo-de-cooperacao-tecnica (accessed 3 May 2023).