An introduction to Brazil’s new internet “bill of rights”

On 23 April 2014, Brazil’s president Dilma Rousseff signed into law the Marco Civil da Internet (Law No. 12,965/2014), Brazil’s “Internet Law”. The Law, which came into force on 23 June 2014, has been hailed by its advocates as an internet “bill of rights”, as it aims to safeguard online freedom of expression, protect users’ privacy and ensure equal access to Brazil’s online population. Its provisions will have far-reaching implications for businesses that provide online services to Brazilian users, including ISPs, search engines, social media websites and other websites hosting user-generated content, as well as online retailers and other services which collect personal information from Brazilian consumers.

Privacy protection

Perhaps the most significant change to Brazil’s online landscape is the introduction of new provisions to protect users’ privacy, as Brazil had never previously introduced any standalone privacy legislation. Under the Internet Law, collection and use of users’ private information is restricted and such information cannot be shared or disclosed by ISPs or other companies operating online, unless they obtain express consent from users or they are required to do so by judicial order or by law.

This not only applies to users’ personal information, but also to information regarding online log in details, contents of private communications (such as emails and instant messaging conversations) and IP addresses. ISPs are obliged to put appropriate measures in place to ensure that those privacy requirements are met and online companies will also have to ask permission from users regarding the collection and storage of private information and in what circumstances it can be shared.

In practice, a company could obtain express consent by making users tick an acceptance check box prior to registration, which would alert them to the company’s privacy policy and ask them whether they agree to the sharing and disclosure of their private information for marketing purposes and/or to third parties.

The Internet Law also requires websites to retain certain user information for specified periods. For example, ISPs must store users’ connectivity information for one year. This includes the dates users connected to the internet, start and end times of their sessions and the IP address of the terminal used.

Net neutrality

Despite opposition from telecoms operators, the Internet Law introduces the principle of “net neutrality”. This means that all data transmissions (i.e. online traffic) must be treated equally by network operators regardless of its content, origin, destination, service, terminal or application. The aim of this provision is to prevent operators from charging higher rates for accessing content that uses greater bandwidth, like video streaming or voice communication services.
User versus ISP liability.

Brazil has embraced social media in recent years; for example, it is now Facebook’s second biggest market after the US. There has been some uncertainty as to who is liable when offensive and infringing content is posted by third parties following a series of cases on the issue in the Brazilian courts. The Internet Law clarifies that ISPs will not be held liable for damages arising from hosting user-generated or uploaded content but would still need to obey court orders obliging them to remove any offensive or infringing material.

Similar to the UK’s Digital Economy Act 2010, Brazil’s Internet Law also obliges the Brazilian government to improve services and connectivity in Brazil and encourage and support the development of new technologies. Despite consumer growth and an increase in living standards in recent years, a study last year found that only 49% of the population accessed the internet in 2013 and with Brazil’s vast remote areas of land, facilitating internet access to everyone is a top priority.

The one that got away

Following revelations that the US’s National Security Agency (the “NSA”) had been gathering significant intelligence information on President Rousseff and majority state-owned oil giant Petrobras, the Internet Law in its original form contained a provision that required ISPs and foreign companies to store all information regarding Brazilian users on servers located within Brazil.

That provision was eventually dropped after strong opposition from the private sector, however, it is important to note that any company with servers located outside of Brazil is still subject to the Internet Law if they provide services to Brazilian users. This will have a considerable effect on global companies like Google and Facebook, which have a strong presence in Brazil. It remains to be seen how this will work in practice; for example, where a company based abroad provides services to Brazilians, there may be conflict between their own privacy or data protection laws and the new Internet Law, leading to compliance difficulties for those companies.

Digital security

It remains to be seen how the Internet Law will be enforced. However, companies that are already taking steps to comply with privacy legislation in other jurisdictions by, for example, introducing privacy policies and providing express consent check boxes, are unlikely to have to make radical changes to comply with it. The Internet Law also imposes new security obligations on companies with an online presence in Brazil and it is essential that companies looking to take advantage of Brazil’s ever-growing online consumer base familiarise themselves with those obligations. Following the NSA spying allegations, the Internet Law is a point of pride for the Brazilian government and they will no doubt be monitoring online activity closely to ensure that it is being complied with.

Co-author:
Poonam Majithia
London
+44 (0)20 7367 2248