May 7, 2020 — a historic day for data protection and fundamental rights in Brazil. To the jubilation of privacy advocates, a landmark ruling by the Brazilian Supreme Federal Court has established that Executive Order N° 954 — a provisional measure mandating the massive sharing of personal data from telecommunication companies with the Brazilian Institute of Geography and Statistics (IBGE) — is incompatible with basic principles of privacy and data protection. Key arguments put forward by the Supreme Federal Court on its decision included:
- Lack of clear definitions and purpose
- Collision with constitutional protection
- Lack of fundamental safeguards
- Lack of necessity and proportionality
This outcome sets the stage for the future of data protection in Brazil, where a data protection law passed in mid-2018 is not yet in effect due to a suspension by government decree MP 959. Moreover, the implications of this ruling have the potential to recognize data protection as a fundamental right, which is not expressly outlined within the Federal Constitution. As part of the court proceeding, Data Privacy Brasil filed an amicus brief and was represented in the oral statement by Director Bruno Ricardo Bioni, who argued, among other points, that personal data protection should be treated as an autonomous fundamental right.
“This decision by the Supreme Court to rule in favor of individuals’ right to privacy is a beacon of optimism in an otherwise bleak scenario for privacy and the protection of personal data in Brazil,” said Rafael Zanatta, Data Privacy Brasil.
One of the main debates in court revolved around the issue of confidentiality or absence thereof. In this regard, a key contribution made by the justices was to move the arguments towards other rights that give rise to data protection, such as human dignity, the right to intimacy and image, as well as the institute of habeas data.
“When it comes to data protection, it is not a matter of confidentiality because whether personal data is private or public is irrelevant; what’s important is that it is personal and an attribute of an individual’s identity,” said Gaspar Pisanu, Policy Associate at Access Now.
Several justices raised the point that the executive order, which requested that phone companies share data concerning names, phone numbers and addresses of all their subscribers, was highly disproportionate and failed to meet several principles of data protection, such as purpose limitation and minimization, security, and transparency. This argument was a key element of the trial, as the court created a necessity and proportionality test for determining if data protection rights and principles are being followed. Moreover, the recognition by justices of the autonomous character of the fundamental right to data protection is a landmark for the country.
“The suspension of this executive order is a huge victory for the data protection community in Brazil. There are many battles ahead of us, but we are finally on the path to securing data protection as a fundamental right,” said Mariana Rielli, Research Lead at Data Privacy Brasil.
For more information on this case, read our blog post.
For more information from Data Privacy Brasil about the research project, The Data and The Virus, visit their website.