Internet Rights Act - Marco Civil da Internet, the Brazilian new act for the internet

Internet Rights Act the Brazilian new act for the internet

Main points of the Brazilian Act 12.965/2014, the “Marco

Civil da Internet”, which establishes guarantees, rights

and obligations for the usage of the internet in Brazil

Brasília, August 2014

Claudio Nazareno

The buzz

Internet Rights Act

– the context & timeline

Main changes introduced by the

new Internet Rights Act

Guarantees the freedom of expression, privacy and the intimacy of users and the inviolability of communications, excepting court orders.

Guarantees that personal information may only be collected and commercialised with expressed consent, and collected data must be excluded when requested by users.

Internet providers (IPs) shall store connections logs for 1 year, are forbade of monitoring user browsing, and data can only be requested by court order.

Brazilian web sites shall store browsing logs for 6 months (court orders can request for longer periods) and collected data can only be requested by court order.

Content posted in third party websites (such as social media) can be removed by the websites or by court orders, with the exception of sexual contents which shall be removed when requested by the affected.

Guarantees net neutrality as a general principle, but allows for traffic discrimination or management, in specific cases.

1

2

3

4

5

6

Guarantees the freedom of expression, users’

privacy and intimacy and the inviolability of

communications, excepting court orders

Legal uncertainty on how to adapt to the

internet rights enshrined in the

Constitution.

Before

The Act clarifies and consolidates in law that constitutional

rights, such as inviolability of

communications and habeas data,

are also valid for the “virtual” world.

Now

Posts on social media and blogs

could be censored even when in

agreement with companies’

policies; webpages could be

blocked by IPs without court

orders; and users privacy could

be violated by data applications

collecting excessive information

without users’ consent nor

knowledge.

Lawful comments or posts

cannot be censored when in

agreement with companies’

internal policies, which must be

explicit; access to webpages

cannot be blocked without court

orders, and; intimacy and privacy

are more protected because data

collection is regulated.

1

Any kind of data can be collected

and commercialised without notice or

users’ authorisation and there is no

guarantee of data exclusion even by

users’ request.

Before

Data may only be collected with users’

previous consent provided that the

collection is related, and not in excess, with the purposes (of the website or

application).

Now

Users’ habits (such as browsing or

e-shopping) and theirs’ generated

content (e-mails and posts) can be

commercialised or handed over to

third parties.

Users will have to explicitly consent for

their internet activity to be collected

(although there is no provision

allowing users to continue to use

services if that consent is not granted).

Excessive data collection is forbidden

(for instance, shopping habits by news

sites, however further regulation is

possibly needed in order to indicate

the acceptable limits).

2

Guarantees that personal information may only be

collected and commercialised with expressed consent,

and collected data must be excluded when requested

by users

There was no obligation but IPs

could store connection logs and browsing activities

indefinitely.

Before IPs shall store

connection logs for 1 year and may not

store users’ web browsing activities.

Now

Internet providers (IPs) shall store connections logs

for 1 year, are forbade of monitoring user browsing

and data can only be requested by court order. (*)

IPs could collect, indefinitely, all

users’ habits with regards to the

internet, connection time,

browsing, shopping, etc.

IPs can still collect connection

logs indefinitely, but have the

obligation to store those logs for

1 year, and they are forbidden of

collecting users’ browsing

activities.

3

(*) Connection logs refer only to users’ IP address, time, date and duration of the connection to the internet;

browsing activities relate to the websites accessed, content posted and all data interchanged by the user.

Brazilian web sites shall store browsing logs for 6

months (court orders can request for longer periods)

and collected data can only be requested by court

order

There was no storing obligation

and websites were allow to store browsing data

indefinitely.

Before Websites and

internet applications shall store users’

activities for 6 months.

Now

Any site or application could collect,

indefinitely, users’ browsing data (by

accepting cookies), even from other

sites and without users’ consent.

Websites are still allowed to store for longer

periods. Websites must inform users if they

collect data from other websites. Data collection

cannot be in excess or in disconnection with

sites purposes. In all cases, users will have to

explicitly consent data collection. Under this

arrangement, users’ information will be

scattered increasing privacy, although this

hampers criminal investigations.

4

The affected/claimant requests to the

website the removal of the content and, if refused, the user can request a court order.

Before

In addition to the previous situation, the Act establishes that, in the case of sexual content, if

the website refuses to take the content

down, they are subjected to prosecution.

Now

Content posted in third party websites (such as social

media) can be removed by the websites or by court

orders, with the exception of sexual contents which

shall be removed when requested by the affected.

Sometimes, websites’ legal representatives

do not comply with court orders (notice and

take down orders) claiming not having

access to data, which is stored abroad (for

instance Facebook). Moreover, websites

do not extend the removal to similar

content replicated within their website (for

instance, the same content uploaded on

YouTube by different users).

Websites’ legal representatives will have to

comply with notice and take down orders

subjected to penalties. In cases of sexual

content, if the removal directly requested

by the affected is denied, companies may

be subsidiary prosecuted for crimes such

as honour violation or unlawful disclosure

of privacy, intimacy or secrecy.

5

There were no rules regarding net neutrality or

forbidding traffic management or

discrimination. IPs could, although disobeying

consumer and competition laws, slow

down or deteriorate certain types of traffic.

Before

Internet traffic can be managed

provided that user is informed of the

policies involved and of plan’s conditions.

IPs and other telecom companies

shall act with transparency,

isonomy and with non-discrimination

ensuring competition.

Now

Guarantees net neutrality as a general principle, but

allows for traffic discrimination or management, in

specific cases.

IPs could deteriorate VoIP calls (for instance,

Skype) or VoD (Netflix) at the expenses of

other applications which they could had

commercial interests in. They could offer

subscription plans with data cap

(10Gb/month for mobiles) or gratuity to

services (free access to Facebook for

prepaid phones).

Competition and consumer law is reinforced explicitly

by guaranteeing that applications (such as Skype,

Netflix, etc.) shall not be degraded. It is indicated that

traffic can be discriminated (managed) for the

appropriate provision of the subscribed services.

Data cap plans are allowed, but there is a legal

controversy if plans with limited access or free

access to certain services or applications would be

allowed (such as free access to Facebook on

prepaid phones).

6

Some reflexions for Brazilian post-Act scenario

Neutrality needs further

regulation, definitions and

delimitations

Privacy and other liberties

enacted need to be fully tested in

court

IPs are more restrained in

their activities than .coms with the enactment of

the bill

Criminal investigations have to seek

different ways of gathering

information which is now

scattered

Internet users have a specific

act for guaranteeing freedom and privacy in the “virtual world”

Thanks!

Claudio Nazareno

Useful links (in Portuguese):

• Internet Rights Act (Lei 12.965/14)

• Lower House Explanatory Document (Fique por

Dentro – Câmara dos Deputados)

• Bill’s discussion forum (Portal E-democracia)