This post is co-authored by Rafael A. F. Zanatta, Research Coordinator at Data Privacy Brasil, and Mariana Marques Rielli, Researcher at Data Privacy Brasil.
A ruling by the Brazilian Supreme Federal Court established that sharing customer data from telecommunication companies with a government office is incompatible with basic principles of privacy and data protection. This ruling is essential for the relevance and future of data protection in Brazil, where a law passed in mid-2018 is not yet in effect due to a suspension by government decree.
Context for the case
On April 17, 2020, the Brazilian government promulgated Executive Order N° 954, which establishes a provisional measure mandating the sharing of data from telecommunication companies with the Brazilian Institute of Geography and Statistics (IBGE), a public institution that conducts statistical research for the Ministry of Economy. According to the decree, the data would be used to calculate unemployment rates, contribute to the National Household Sample Survey, and support official statistical production during the COVID-19 public health emergency
The provisional measure in the executive order required telcos to share with IBGE a list of all customer names, telephone numbers, and addresses which would have been used for statistical purposes.
Privacy advocates were worried about the government plan because the law that was passed in 2018 – and that may have offered some protections in this case – is not legally in effect , as it was suspended by government decree.
The lawsuits on the decree
The Brazilian Bar Association and four different political parties filed five lawsuits on constitutional grounds arguing that the provisional measure lacks reasonableness and proportionality. The lawsuits also explained that the provisional measure violates constitutional provisions that safeguard the fundamental rights to privacy, honor, and dignity. On April 24, Supreme Federal Court Minister Rosa Weber granted the injunction pleaded by the plaintiff — ad referendum of the plenary — “to suspend the effectiveness of Provisional Measure No. 954/2020, determining, consequently, that the Brazilian Institute of Geography and Statistics (IBGE) abstain from requesting the availability of the data subject to the provisional measure and, if it has already done so, to suspend such requests.”
To help the court decide, the organization, Data Privacy Brasil, intervened as amicus curiae. Representing the non-governmental organization before the court, Bruno Bioni argued that personal data protection should be treated as an autonomous fundamental right and that the measure violates constitutional norms regarding human dignity, due process, and protection of private life, all of which are fundamental rights protected by Article 5 of the Brazilian Constitution. The contribution highlights the need to comply with the principle of proportionality and with rules of informational due process when it comes to interference with human rights, as well as highlighting the lack of sufficient safeguards to prevent potential violations and abuses.
The ruling
Fortunately, the Supreme Federal Court listened to the warnings and concerns from civil society on May 7, and by a vote of 10 to 1, the plenary session decided to confirm the suspension of the provisional measure. Some of the key arguments put forward by the Supreme Federal Court were:
| Lack of clear definitions and purpose |
| The executive order does not define the object of the statistic to be produced, the specific purpose, or its extension. According to Rosa Weber, “by not properly defining how and what the collected data will be used for, the measure does not offer conditions for assessing its suitability and necessity. Thus, it disregards the guarantee of due legal process.” |
| Collision with constitutional protection |
| The information that telecommunication companies are ordered to provide constitutes personal data and, as such, it is protected by the constitution, which ensures individual freedom, privacy, and informational self-determination. The executive order does not comply with the limits outlined by the constitutional protection. |
| Lack of fundamental safeguards |
| The executive order does not have a technical or administrative mechanism to protect personal data from unauthorized access, accidental breaches, or misuse. Weber stressed that, while the severity of the health crisis cannot be underestimated, nor the need to formulate public policies for the collection of personal data to fight the pandemic, this cannot legitimize the trampling of fundamental guarantees enshrined in the constitution. |
| Lack of necessity and proportionality |
| Weber highlights that the IBGE used data already collected by the national survey conducted early in 2019 to estimate the number of people with COVID-19 symptoms and measure the impact of the pandemic on the labor market. This shows that there are better, less invasive ways to obtain and conduct research without the need for telcos to share customers’ personal data. |
An important step that paves the way for effective data protection
The Supreme Federal Court took a significant step toward the protection of personal data as right in itself, creating an important precedent in constitutional law. According to Justice Gilmar Mendes, constitutional norms regarding fundamental rights create a positive obligation for the state to guarantee the exercise of those rights by the citizens. The ruling is a clear message to the government of Jair Bolsonaro: adequate protection demands a data protection authority, not the constant postponement of legislation.