The revolutionary legislation that served as a model for digital rights regulation globally is now in danger. Here is how some foreign ideas risk breaking the Marco Civil.
In 2014, the government of Brazil passed a piece of legislation known as the Marco Civil da Internet, a civil framework for the internet that gives legal status to a set of fundamental principles for digital rights for all Brazilians. The Marco Civil managed to reconcile the interests of various internet stakeholders into one text, thanks to a broad public consultation. The result is not perfect in terms of safeguarding users’ rights, but it nevertheless represents a successful endeavour in participatory governance.
Only one year later, however, the principles in the Marco Civil are being threatened by Brazil’s own legislative representatives. In February 2015, lawmakers introduced a dangerous bill in the Câmara dos Deputados – Brazil’s house of representatives – that aims to reform key provisions in the Marco Civil to the detriment of the rights to privacy and freedom of expression. Those supporting the bill say that it’s a necessary tool to defend the honor of Brazilians online.
Requests for more personal information with fewer safeguards
One of the areas where the Marco Civil falls short with regard to protecting users rights is a provision for mandatory data retention, a practice that Access Now has repeatedly denounced because it is at odds with international human rightsprinciples. Now, the Espiao bill would make use of a loophole in the law to enable more personal information to be accessed without a warrant.
Article 13 of the Marco Civil requires that internet service providers, or ISPs, keep connection logs for all their users for one year. Article 15 contains a similar requirement for “application providers” such as Facebook, which must keep log-in records for six months. Under the Marco Civil, information collected under either one of these provisions can be accessed only by authorities with a court order, which constitutes a safeguard for users.
Yet at the same time, the law allows administrative authorities – such as the police and public prosecutors – to get certain registration information from providers without a warrant. This information comprises name, affiliation, and address. The Espiao bill seeks to add to this list, so that it would include telephone number, email address, and national ID number, known as CPF.
Additionally, the Espiao bill would force internet service providers and application providers to obtain, organize, and make that data available to administrative authorities upon their request.
That obligation is problematic for a number of reasons. First, it adds to the list of registration information with data that qualifies as personal in nature. Further, there is no comprehensive data protection legislation presently in force in Brazil and therefore, there are no safeguards or principles in place to protect that personal data.
Second, forcing ISPs and application providers to obtain, organize, and provide that data to authorities would put user privacy at risk by enabling the creation of massive databases of personal information with no data protection safeguards whatsoever. Data protection principles such as data minimization – contained in the official draft for a data protection bill in Brazil and in the European directive, among other pieces of legislation – specifically advise against collecting and storing information that is not necessary or pertinent.
The Espiao bill would also seriously damage the freedom of expression. It is possible that the obligations in the bill would impose mandatory registration for all internet users in Brazil. Users at risk – for example, political dissidents, gender activists, and whistleblowers – would not be able to rely on anonymity to express their views online.
The public interest: a forgotten right
In addition to the aim of strengthening protections for users’ honor online, the Espiao bill also proposes a Brazilian implementation of the so-called right to be forgotten. The bill proposes that any citizen could go to a judge and request that any content on the internet to be “made unavailable,” as long as the content is defamatory, libelous, or refers to a crime where the interested party was absolved.
The problem with this and other proposed implementations of the so-called right to be forgotten is that lawmakers fail to strike the proper balance between privacy rights and the public’s interest in accessing information that might be essential for public debate. The mechanism in the Espiao bill does not even mention the public interest, and would justify deletion of certain information for data protection. The Court of Justice of the European Union took the public interest into consideration in deciding the case that originated the right to be forgotten “hype.” The court ordered search engines to delist the name of the plaintiff from certain search results – thus leaving the information available on certain web pages – only in cases where the plaintiff is not a public figure, or when the information is not of interest to the public.
Granting an absolute right to delete internet content based on considerations related to libel or defamation is also problematic in the Brazilian context. As researchers from the Centro de Tecnologia e Sociedade at FGV, the University of Sao Paulo, and InternetLab have recently shown, there is no clear criteria yet in Brazilian jurisprudence regarding the extent of the right to request deletion of purportedly defamatory or libelous content online. There are too many type of content that might be considered defamatory and the considerations surrounding them vary too much from case to case.
Take action and spread the word
So far, the Espiao bill has made it through the special commissions in Brazil’s house of representatives and will soon be put to a vote before the plenary. It still has to be approved by Brazil’s house and senate before it’s passed into law, but activists are already campaigning against it. A coalition of organizations including Coding Rights, Actantes, Article 19, and the Electronic Frontier Foundation have built a tweeting platform to alert representatives to the issues with the bill. We encourage you to add your voice to that campaign, and to share this post.
The great advancements for users’ rights enshrined in the Marco Civil are in danger, but we have the chance to make our voices heard. We hope you speak out, and we’ll keep you posted as the situation develops.