W7y8w3

the matter of the retention of log files. EdwardSnowden’s espionage claims directly involving theBrazilian government, in the second half of 2013,brought Rousseff into the discussion, and pulledthe Marco Civil back onto the legislative agenda.The executive branch determined discussionof the bill in Congress to be of “constitutional urgency”,and it came to lock the agenda of votes inthe lower house on 28 October 2013 (in line with theBrazilian constitution, if a bill granted “urgency”has not been voted on within 45 days, deliberationon all other legislative matters is suspended inthat house of Congress until voting is concluded).Nevertheless, resistance, a congressional recessand political manoeuvring delayed its approvalfor almost five more months – until it was finallyapproved on 25 March 2014. In the Senate, the pressurefor approval, the proximity of the NETmundialevent, and a composition of senators more favourableto the government helped the voting to takeless than one month. Through all this, mobilisationof civil society through online campaigns, messagesbeing sent to members of Congress, increasedpublic awareness through social media networks,public events and lectures, and the physical presenceof activists in the halls and plenary sessions ofthe National Congress, were fundamental. 4Data protection and privacy:One of the pillars of the Marco CivilPrivacy protection and personal data protection are,separately, two of the principles provided for by lawto regulate the use of the internet in Brazil (in Article3). The clauses in the Marco Civil dealing withthese protections were strengthened after EdwardSnowden’s public allegations of mass surveillance,and an important set of such provisions are set forthin Article 7 of the law. Such provisions ensure theinviolability and secrecy of the flow of communicationson the internet and of stored private data,except if disclosure is required by court order. Theinviolability and secrecy of data and communicationsare rights guaranteed under the BrazilianFederal Constitution, but the judiciary understandsthat such provisions are only applicable to the flowof communications, not to communications that arestored. The Marco Civil represents a breakthroughin the protection of stored data.4 Idec made an online tool available that sent thousands of emailsto members of the House of Representatives; Avaaz collected350,000 signatures supporting the Bill through online petitions.Numerous organisations and activists mobilised using theseand other tools forming a cohesive and coordinated front. See:marcocivil.org.brAnother advance concerns the more detailedprovision of the law that requires express (notimplied) consent from the subject for the future collection,use, storage and handling of personal data,which should be given separately from any othercontractual clauses. In addition, the user must haveaccess to clear and complete information aboutthe processes of storage, including the system ofprotection of connectivity logs and data recordingaccess to applications. The disclosure of personaldata to third parties may only occur if there is expressconsent, informed and free. Subject to theprinciple of purpose, the same article provides thatpersonal data may only be used for purposes thatjustify their collection, when not prohibited by law,and are specified in the services agreement or theterms of use of internet applications.As a corollary to Article 7, Article 8 of the MarcoCivil states that the guarantee of the right to privacyand freedom of expression in communicationsis a prerequisite for the full exercise of the right toaccess the internet. Accordingly, any contractualclause in breach of these provisions, such as thoseinvolving harm to the inviolability and privacy ofcommunications on the internet, will be considerednull and void.In order to fight the surveillance reported bySnowden, Article 11 determines that Brazilian lawrelated to privacy must be respected by internetconnectivity and applications providers when collectingpersonal data, logs and communicationscontent when this occurs in the country or involvesa terminal located in Brazil. This obligation also appliesto legal entities domiciled abroad, providedthat they offer services to the Brazilian public orthat any member of their business group has a businessunit in the country.Part of the law is also aimed at establishing parametersfor the retention and availability of logs forconnectivity and access to applications. Generally,the obligation to make these logs available dependson a court order. As regards retention, the Marco Civilprovides for two cases in which it can occur. The first,in Article 13, refers to connectivity logs (date and timeof beginning and end of a connection, its durationand the IP address). The system administrator mustkeep them private, and in a controlled and safe environment,for a period of one year, according to theregulations. The second, in Article 15, refers to logsof access to applications (date and time of use of anapplication from a particular IP address). In the caseof applications whose providers are legal for-profitentities, the retention of these logs shall be compulsoryfor six months, also pursuant to the regulations.Initially provided for as optional, the compulsorycharacter of the retention was a late change to thebill, the result of pressure from the federal police andrelated sectors, causing great controversy amongcivil society organisations. Finally, it is important tomention that connectivity providers are prohibitedfrom storing access to applications logs, and may notstore these together with connectivity logs.The provisions commented on here do not compriseall the Marco Civil rules applicable to privacyand personal data, but represent many of them. 5There are also two other pillars of the law that areworth noting.One is net neutrality, which is guaranteed asone of the principles governing the use of the internetin Brazil. In order to give effect to it, Article 9establishes that the entity responsible for transmission,switching or routing must treat any data packsequally, irrespective of content, origin and destination,service, terminal or application. The article alsoforbids these entities from blocking, monitoring, filteringor analysing the contents of the data packs.Two exceptions are provided, and these may resultin discrimination or the degradation of data traffic:i) due to technical requirements necessary for theadequate supply of services and applications, andii) for prioritising emergency services. Even in thesecases, there are conditions that providers mustmeet, such as refraining from doing harm to usersand not engaging in anti-competitive conduct. Exceptionswill be regulated by presidential decree,after input from the National TelecommunicationsAgency and CGI.br. While telecommunications companieshave managed to include the principle thatgrants “freedom of business models” among theprinciples of law, it is the only clause which includesthe phrase “provided they do not conflict with otherprinciples under this law” – including net neutrality,detailed in Article 9.Another important pillar is the issue of intermediaryliability with respect to third-party content.According to the general rule laid down in Article 19of the law, civil liability for third-party content mayonly occur if the provider of applications fails to complywith a court order requiring the removal of thecontent. This provision is to ensure due process, aswell as the competent judicial scrutiny on the variousrights involved in removal requests. There are,however, two exceptions worth noting. In the caseof content protected by copyright, until a specific5 For further analysis, see Doneda, D. (2014). Privacy and dataprotection in the Marco Civil da Internet. www.privacylatam.com/?p=239; an unofficial translation of the law is available at:thecdd.wordpress.com/2014/03/28/marco-civil-da-internetunofficial-english-translationprovision of law is adopted for the application of thisrule, the current Brazilian Copyright Act remainsapplicable, which allows a much more restrictive approachto access to knowledge. The second exceptionis the notice and takedown for breaches of privacy bydisclosure of nudity or private sexual acts without theconsent of the participants. However, the notificationmust be made by the participant or his/her legalrepresentative, aiming to avoid moralistic and judgmentalcensorship which is not rare at all on the net.Action stepsThe reaction that initially consolidated the idea of acivil rights framework for the internet in Brazil wasstrengthened with the release of the documentsleaked by Snowden. The idea that the regulationof the internet should move away from a persecutory,surveillance approach in order to guaranteethe right to privacy and other rights has been reinforced.However, such a conception of internetregulation cannot settle without considerable difficulties– and the Marco Civil is an expression of this.Despite the mobilisation, civil society was not ableto contain the pressure for mandatory retention oflogs. However, it did succeed in restricting the timeperiod that logs could be retained – a period shorterthan the authorities wanted.The regulation on the retention of logs, especiallylogs that record a user’s access to applications, mayfurther limit the types of service providers requiredto retain logs and improve transparency and controlmechanisms related to data retention. Moreover, aspecific bill on protection of personal data is expectedto be sent to the Brazilian Congress soon. Thiscan minimise the problematic aspects of the MarcoCivil which, in general terms, introduces importantregulations for the protection of user’s privacy onthe internet into Brazilian legislation. Beyond thispoint, the law has other important advances, notablythe provisions on net neutrality and intermediaryliability. In both cases, the guarantee of rights wasset against commercial interests and the threat ofcensorship. In the future, we can expect pressureto continue to build with regard to exceptions to netneutrality, and changes to the Copyright Act, which isalso expected to be sent to Congress.If disputes follow the approval of the MarcoCivil, including the challenges surrounding its effectivenessand continuity, it is certain that thesedisputes will at least begin from an informed perspective.This includes considering the internet asa rights-based issue, essential to the exercise ofcitizenship, and which requires the guarantee ofprivacy and freedom of expression.84 / Global Information Society Watch brazil / 85