UPDATED: December 2022 | SOURCE: GW Law and Derechos Digitales Update to Hogan Lovells Commissioned Report

Provision of Real-time Lawful Interception Assistance

The inviolability of private communications in Brazil is established in the Constitution and several pieces of legislation.

BRAZILIAN FEDERAL CONSTITUTION

Paragraphs IX, X and XII of Article 5 of the Brazilian Constitution protect freedom of speech, the right to privacy, and the secrecy of private communications in Brazil. Article 5, paragraph XII states that the secrecy of correspondence and of telegraphic data and telephone communications is inviolable except, in the latter case, by court order in the circumstances and manner prescribed by law for the purposes of criminal investigations or proceedings.

Pursuant to Article 8.2(h) of the Inter-American Human Rights Convention and Article 5, paragraph XXXV of the Brazilian Constitution, any court decisions that threaten or harm constitutional rights may be appealed to a court of higher instance.

Following the Constitutional Amendment No. 115 of February 10, 2022, Article 5, Paragraph LXXIX of the Constitution guarantees the right to the protection of personal data, including in digital media. Amendments to Articles 21 and 22 of the Constitution establish the Union’s competence and authority to legislate on the protection and processing of personal data. (More details on data protection legislation are available in this report under the LGPD section in “Oversight of Access-Related Powers”)

LAW 9.472/97 ORGANIZATION OF TELECOMMUNICATIONS SERVICES, THE CREATION AND OPERATION OF A REGULATORY BODY AND OTHER INSTITUTIONAL ASPECTS

Under Article 3 of Law 9.472, users of telecommunications services are entitled to the inviolability and secrecy of their communications (except where set out by law) and respect for their privacy in the collection of documents and in the use of personal data by communication service providers (“CSPs”).

Article 72 establishes that personal information can only be disclosed to third parties with the user’s authorization.

DECREE-LAW 3.689/41 CRIMINAL PROCEDURE CODE (“CPC”)

Article 156 of the CPC establishes that judges can proactively order the collection of evidence by specific means, considering the principles of necessity, adequacy and proportionality. In addition, when it comes to the interception of communications in particular, article 3 of Law 9296/96 establishes that judges can request them directly on their own initiative, or at the request of the police authority or the Public Prosecutor’s Office.

When the requirements set out in Article 2 of Law 9.296/96 are met, as set out in more detail below, the court can order production of evidence through the interception of communications. It is important to note that a recent reform of the CPC through Law 13.964/19 introduced a double-judge system, establishing a supervisory judge (“juiz das garantias”) to be appointed to oversee a criminal investigation and guarantee the legality of that process. The supervisory judge is responsible for deciding on proposed investigatory measures that can potentially limit individual rights, including the request for the interception of communications. The implementation of the functions of the supervisory judge, however, was suspended as a precautionary measure by the Brazilian Supreme Court in January of 2020. As of October 2022, the Supreme Court had not yet resolved the underlying case (ADI 6299) challenging the effectiveness of Law 13.964/19.

At the same time, Law 13.964 amends the CPC by adding Art. 3(B)(XI), which says that the trial-level judge is responsible for making all decisions regarding: a) telephone interception, communications flow in computer and telematics systems or other forms of communication; b) removal of fiscal, banking, data and telephone confidentiality; c) house search and seizure; d) access to confidential information; and e) other means of obtaining evidence that restrict the fundamental rights of the person being investigated.

LAW 9.296/96 REGULATING ARTICLE 5, XII OF THE CONSTITUTION

The police (in the course of a criminal investigation), or the Federal or State Public Prosecutor’s Office (in the course of an investigation or criminal proceedings) may request authorization from the court to obtain evidence for criminal investigations through telephone interception. Under Article 2 of Law 9.296/96, in order for such evidence to be validly obtained, there must be a reasonable suspicion that the alleged perpetrator has committed a crime and no other means available for producing the evidence of the alleged crime. In addition, the alleged crime must be punishable by imprisonment, which limits the application to a set of criminal offenses as defined in the Brazilian Penal Code. If these criteria are met, Article 3 requires that a court authorize the interception in accordance with the CPC as noted above.

Article 4 of Law 9.296 establishes the standard of necessity for a telecommunications interception request and the maximum term of twenty-four hours for the judge to decide it.

According to Article 5, the court’s interception measures cannot exceed 15 days in duration and must be the product of a reasoned opinion from the Court, however, Article 5 specifies that the order is renewable for another 15 days once the indispensability of the evidence has been proven, and previous rulings have indicated that an interception order may be renewed at any time for as long as required where there is a basis to do so.

Under Articles 6 and 7 of Law 9.296/96, the authority authorized to perform the interception may require that communications service providers (“CSPs”) provide specialized technicians and services to aid in the interception. The authority which requested the interception has primary responsibility for the investigation, but may delegate responsibilities to the personnel of CSPs, who must in turn pass any information obtained through the interception back to the relevant authority.

In 2019, new provisions of Law 9.296/96 were added, through Law 13.964/2019, regarding the capture of electromagnetic, optical or acoustic signals in private or public spaces with a court order (article 8-A). A judge, at the request of the police or the Public Prosecutor, may grant such capture when:

  • the evidence cannot be obtained by other available and equally effective means; and
  • there are reasonable evidential elements of authorship and participation in criminal infractions whose maximum penalties are greater than 4 years or in related criminal infractions.

The application must describe in detail the location and form of installation of the ambient capture device. The requested period of capture may not exceed the term of 15 days, renewable by judicial decision for equal periods if the indispensability of the evidence is proven and when the requesting authority demonstrates permanent, habitual or continued criminal activity.

Under Article 10 and 10-A introduced by Laws 13.869/2019 and 13.964/2019, it is a crime to: intercept telephone, computer or telematic communications, including intrusions into IT systems and software; facilitate or conduct ambient capture of electromagnetic, optical or acoustic signals for criminal investigation or instruction; or breach judicial secrecy, without judicial authorization or for purposes not authorized by law. Under Articles 10 and 10-A of Law 9.296/96, authorities executing interception or monitoring activities without judicial authority or beyond the scope of judicial authority are subject to criminal penalties.

LAW 12.965/14 ESTABLISHING PRINCIPLES, GUARANTEES, RIGHTS AND DUTIES FOR THE USE OF THE INTERNET IN BRAZIL (“Marco Civil” Law)

Article 3 of the Law 12.965, known as the “Marco Civil” Law, recognizes that the regulation of Internet use in Brazil must respect the right to privacy and protection of personal data, not excluding other principles set out in other Brazilian laws related to this matter or in the international treaties to which Brazil is a party.

Article 7 of the Law guarantees certain rights for internet users, including the inviolability and secrecy of communications over the Internet, except by judicial order in accordance with the law.

Article 10 of the Marco Civil establishes that the retention and release of connection logs and access to internet applications logs, as well as of personal data and of the content of private communications, must comply with the protection of privacy and other individual rights. Article 10(2) confirms that the content of private communications may only be made available by court order, while Article 10(3) clarifies that this obligation does not prevent administrative authorities expressly authorized by law from obtaining access to recorded data that informs personal qualification, affiliation and address. Similar provisions are also found in Law 9.613/1998 on money laundering and Law 12.850/2013, on organized crime. (See more on data retention requirements under the same law in the “Disclosure of Stored Communications Data” section of this report.)

Marco Civil Article 22 establishes the right of parties in civil or criminal proceedings to access “connections or access logs” for use as evidence. The judge in any such proceeding, at the request of an interested party, will order the entity responsible for the keeping of such records to produce them, if the requesting party can provide 1) justified evidence of illicit activity; 2) motivated justification of the usefulness of the requested records for investigation or probative instruction; and 3) the period of time to which the records correspond.

ANATEL RESOLUTIONS

The Brazilian National Agency for Telecommunications (“ANATEL”) has the authority to regulate and monitor communications service providers in Brazil.

Article 65-H of the Telecommunications Services Regulation, as amended by Anatel Resolution 738/20, clarifies that providers must ensure the confidentiality of communications and the confidentiality of the data of users of their services, including connection records. Article 65-H also clarifies that providers must use necessary and available technological resources to ensure the inviolability of the confidentiality of communications, and retain the minimum amount of user data necessary.

Pursuant to Article 65-K of the Telecommunications Services Regulation, as amended by ANATEL Resolution 738/20, providers must make available technological resources required to access private communications and conduct interceptions. Which technologies are required is determined by a judge or other entity legally vested with such powers. Service providers must bear the financial costs of this technology.

Disclosure of Communications Data

DECREE-LAW 3.689/41 CRIMINAL PROCEDURE CODE (“CPC”)

Article 13-B of the Criminal Procedure Code authorizes the Public Ministry to require telecommunications providers to make available the technical means necessary for identifying the location of victims and/or suspects of crimes related to human trafficking. Providers must comply with the request within a maximum of 72 hours. This provision does not authorize the access to the content of the communications which can only be obtained through a court order, as defined in Law 9296 explained above.

ANATEL RESOLUTIONS

Pursuant to Article 7 of the Regulatory Supervision Regulation, as approved by Resolution 746/21, CSPs must provide ANATEL with data and information of a technical, operational, economic-financial, accounting, or other relevant nature that it requests. Some researchers have expressed concern that an online system could be in place allowing ANATEL to have direct and unlimited access to this information on CSPs’ internal systems for any purpose, which would emanate from Article 65-K of the Telecommunication Services Regulation, as amended by Resolution 738/20,

Article 65-J of the Telecommunications Services Regulation, as approved by Resolution 738/20, establishes that, in order to ensure supervision and monitoring, providers of fixed, mobile and multimedia communications services must, consistent with relevant regulations, make available to ANATEL a minimum of five years of data related to provision of services, including subscriber, fiscal, and billing data and data about calls made and received, including date, time, duration, and cost. They must also be able to provide a minimum of one year of Internet connection records, including the start and end date and time of an internet connection, its duration, and the IP address and ports used.

LAW 12.965/14 ESTABLISHING PRINCIPLES, GUARANTEES, RIGHTS AND DUTIES FOR THE USE OF THE INTERNET IN BRAZIL (Marco Civil)

The “Marco Civil” Law determines retention of metadata regarding connection logs and registrations of access to Internet applications. Article 5 defines “connection logs” as “information pertaining to the date and time of a connection to the Internet, the duration thereof, and the IP addresses used by the terminal to send and receive data packages.” Article 5 defines “registrations of access to Internet applications” as “the set of information regarding the date and time of use of particular internet applications from a particular IP address.” Communications service providers are obliged to retain metadata generated by internet connections for one year under Article 13, while internet application providers are required to store such data for six months according to Article 15. However, Article 14 prohibits the retention of records of users’ access to Internet applications.

Article 10 of the Marco Civil establishes that the retention and the making available of connection logs and access to internet applications logs must comply with the protection of privacy and other individual rights; however, in Article 10(3), it clarifies that this obligation does not prevent administrative authorities expressly so authorized by law from obtaining access to recorded data that informs personal qualification, affiliation and address. Similar provisions are also found in Law 9.613/1998 on money laundering and Law 12.850/2013 on organized crime.

According to Article 15, Internet application providers operating in Brazil must keep a confidential record of application access logs in a controlled and safe environment for six months, as detailed in regulation. While according to Article 13, ISPs must keep records of connection logs for at least one year, the police, administrative authority, or Public Prosecutor’s Office can request the records be kept for a longer period pursuant to Article 13(2). However, Article 14 prohibits the retention of records of users’ access to Internet applications.

Marco Civil Article 22, in turn, establishes the right of parties in civil or criminal proceedings to access “connections or access logs” for use as evidence. The judge in any such proceeding, at the request of an interested party, will order the entity responsible for the keeping of such records to produce them, if the requesting party can provide 1) justified evidence of illicit activity; 2) motivated justification of the usefulness of the requested records for investigation or probative instruction; and 3) the period of time to which the records correspond. The court that orders the production of such evidence must ensure the confidentiality of the data and determine to what extent the information gathered can lawfully be used in the proceedings (Article 23).

The Marco Civil and other access-related powers do not include particular conditions or requirements for access to metadata from telephone communications (as opposed to Internet), beyond the specific protections outlined in the Constitution and Law 9.472/97 (see “Provision of Real-time Lawful Interception” above).

LAW 12.850/13 ESTABLISHING MEASURES AGAINST ORGANIZED CRIME

According to Article 17 of Law 12.850, fixed and mobile telephone providers will keep, for a period of five years and at the disposal of the police chief and the Public Prosecutor’s Office, records identifying the numbers of the source and destination terminals for international, long distance, and local telephone calls.

National Security and Emergency Powers

BRAZILIAN FEDERAL CONSTITUTION

Under the Brazilian Constitution, the President can adopt measures restricting the right to secrecy of correspondence and telecommunications upon declaring: (i) a state of national defense, pursuant to Article 136.1, I (b)(c); or (ii) a state of siege, pursuant to Article 137, I and 139, III. Both executive actions are subject to time restraints (usually 30 days) and must be approved by an absolute majority of the National Congress. A state of national defense must be to preserve or promptly re-establish public order or social peace threatened by grave and imminent institutional instability or affected by large scale natural calamities. A state of siege follows if the state of national defense is insufficient, or there is war.

Moreover, the Supreme Court has jurisdiction to review the establishment of the state of national defense or siege.

LAW 9.883/99 CREATING THE BRAZILIAN INTELLIGENCE SYSTEM

Law 9.883/99 created the Brazilian Intelligence Agency (“ABIN” – Agência Brasileira de Inteligência) and the Brazilian Intelligence System (“SISBIN” – Sistema Brasileiro de Inteligência). ABIN is a body within the Office of the President, whereas SISBIN is an integrated system of governmental agencies and authorities that provide information to the President of the Republic on matters of national interest, pursuant to Article 1 of the Law.

Under Article 3, ABIN plans, executes, coordinates, supervises and controls all intelligence activities in Brazil in accordance with the requirements set out therein. ABIN is also entitled to request cooperation from other agencies through SISBIN pursuant to Articles 6, V and 6-A of Decree 4.376/02.

ABIN does not have the authority to conduct interceptions independently. Under Article 6 of Law 9.296/96, the police have exclusive authority to perform interceptions. However, ABIN may seek a court order requiring the police to intercept personal data at ABIN’s request. ABIN cannot demand information such as communications metadata directly. However, as it is the operator of the SISBIN, ABIN may access data in possession of members of the SISBIN (Articles 6, V and 6-A of Decree 4.376/02).

Oversight of the Use of Powers

BRAZILIAN FEDERAL CONSTITUTION

Pursuant to Article 8.2(h) of the Inter-American Human Rights Convention, as ratified July 9, 1992, and Article 5, XXXV of the Brazilian Constitution, any court decisions that threaten or harm constitutional rights may be appealed to a court of higher instance.

DECREE-LAW 3.689/41 CRIMINAL PROCEDURE CODE (“CPC”)

Article 157 of the CPC declares evidence to be admissible in judicial processes when it has been acquired in violation of constitutional or legal provisions.

A recent reform of the CPC through Law 13.964/19 introduced a double-judge system, establishing a supervisory judge (“juiz das garantias”) to be appointed to oversee the criminal investigation and guarantee the legality of that process. The supervisory judge is responsible for deciding on proposed investigatory measures that can potentially limit individual rights, including the request for the interception of communications. The implementation of the functions of the supervisory judge, however, was suspended as a precautionary measure by the Brazilian Supreme Court in January of 2020. As of August 2022, the Supreme Court had not yet resolved the underlying case (ADI 6299) challenging the effectiveness of Law 13.964/19.

At the same time, Law 13.964 amends the CPC by adding Art. 3(B)(XI), which says that the trial-level judge is responsible for making decisions about: a) telephone interception, communications flow in computer and telematics systems or other forms of communication; b) removal of fiscal, banking, data and telephone confidentiality; c) house search and seizure; d) access to confidential information; and e) other means of obtaining evidence that restrict the fundamental rights of the person being investigated.

LAW 12.965/14 ESTABLISHING PRINCIPLES, GUARANTEES, RIGHTS AND DUTIES FOR THE USE OF THE INTERNET IN BRAZIL (Marco Civil)

Article 7, VIII of Law 12.965 guarantees that users have the right to receive clear and complete information on the collection, use, storage, processing and protection of their personal data. This data can only be used for purposes that justify its collection, are not prohibited by law, and are specified in companies terms of service agreements.

As detailed above in the “Disclosure of Stored Communications Data” section of the report, Article 14 of Law 12.965 prohibits the retention of records of users’ access to Internet applications. However, the law does include some requirements for both communications service providers and application providers to retain some metadata around connections to the internet under Articles 13 and 15.

LAW 9.883/99 CREATING THE BRAZILIAN INTELLIGENCE SYSTEM

Article 6 of the Law provides for external control and monitoring of ABIN by a commission instituted by Congress’ Mixed Commission of Intelligence Activities Control (“CCAI”- Comissão Mista de Controle das Atividades de Inteligência). CCAI is not a standing body and has been assembled only on a few occasions and in relative emergencies.

Law 13.709/18: THE GENERAL PERSONAL DATA PROTECTION ACT (LGPD)

Law 13.709/18, the General Personal Data Protection Act (LGPD), regulates the processing of personal data by public and private actors. It establishes data subject rights to know what data is processed; to correct erroneous, incomplete or outdated data; to erase, anonymize or delete unnecessary data and data collected in violation of the law; to oppose data processing when such process is unlawful; and to request review of the results of automated decision-making.

Article 4(III) excludes from its protections data processing processes related exclusively to public safety, national defense, state security, and the investigation and prosecution of criminal offenses. However, Section 1 of the same Article clarifies that processing of personal data as provided in item III shall be governed by specific legislation, which shall provide proportional and strictly necessary measures for fulfilling the public interest, subject to due legal process, the general principles of protection, and the rights of the data subjects as provided in this Law.

The LGDP also created the National Data Protection Authority (ANPD) within the Executive Branch, along with a Board of Directors, a National Council for the Protection of Personal Data and Privacy, and other administrative units. Subsequently, the legislature enacted Law 13.853/19, which amended Article 55-E of the LGPD to insulate the ANPD’s Board of Directors from direct or immediate executive influence by protecting its members from removal by the President without prior resignation, final judicial conviction, or disciplinary administrative proceedings. Law 13.853/19 further amended Article 55-D of the LGPD to require the Brazilian Senate’s approval of appointments proposed by the President to the ANPD’s Board of Directors. Finally, in June 2022, President Jairo Bolsonaro issued an executive order (Provisional Measure No. 1,124/22) designating the ANPD as an “autarchy of a special nature … endowed with technical and decision-making autonomy, with its own assets and with headquarters and jurisdiction in the Federal District.” However this resolution is subject to additional renewals for 60 day periods, subject to congressional approval, so this structure and authority for the ANDP is not permanent at the time of writing (December 2022).

Article 55-J of the LGPD outlines the responsibilities and powers of the ANPD, including the investigation and sanction of cases of data processing which breach the LGPD through an administrative procedure subject to appeal. Articles 55-J(XI) and (XVI) of the LGPD similarly empower the ANDP to audit public or private processing agents as part of an investigation, or public authorities even absent an investigation to ensure compliance with the LGPD.

Censorship-related Powers

BRAZILIAN FEDERAL CONSTITUTION

Paragraph IX of Article 5 of the Brazilian Constitution guarantees the right for expression of intellectual, artistic, scientific, and communication activity that is free, independent of any censorship or license.

LAW 12.965/14 ESTABLISHING PRINCIPLES, GUARANTEES, RIGHTS AND DUTIES FOR THE USE OF THE INTERNET IN BRAZIL (Marco Civil)

Articles 2 and 3 of Law 12.965 reaffirm the fundamental principles that govern Internet activities in Brazil, especially the respect for freedom of expression, communication and opinion. Article 3 adds the preservation of network neutrality. Furthermore, Article 4 establishes the fundamental right to access to the internet.

Under Article 12 of Law 12.965/14, courts may temporarily suspend or prohibit the operation of internet service providers or internet application providers in the country if they fail in observing national law and the rights to privacy, data protection, and confidentiality of communications and metadata – as provided for in Articles 10 and 11.

Courts may also suspend the activities of certain applications where the website’s content is illegal (such as, for example, child pornography), following the case of REsp 1308830 / RS decided by the Brazilian Court of Justice.

According to Article 19 of Law 12.965/14, in order to ensure freedom of expression and prevent censorship, civil responsibility for third-party content will only be allowed if an intermediary does not comply with a court order for the removal of content. However, the law is silent on liability for any decision to remove or restrict content (i.e., it does not provide an explicit “Good Samaritan” protection).

According to Article 21 Law 12.965/14, internet application providers that make third-party content available can be held liable for failing to remove, upon receiving notice from the affected “participant-user” or their representative, images, videos, and other materials containing nudity or sexual activities of a private nature, without the consent of the persons involved. Such notices must contain sufficient elements to allow for the identification of the specific material alleged to violate the right to privacy, as well as confirmation of the legitimacy of the affected participant-user presenting the request.

In 2016, several federal judges ordered the blocking of WhatsApp for failing to comply with demands from prosecutors to provide user content. In 2017, a preliminary decision from the Brazilian Supreme Court (“STF”) overturned one of these lower court orders restricting access to the WhatsApp application nationwide. In that decision, Justice Lewandowski stated that the injunctive order was disproportionate and threatened freedom of expression.

Prior to issuing its preliminary decision, the STF held a hearing in June 2017 to discuss the constitutionality of the lower court order. At the same time, the Court also heard arguments about the constitutionality of court orders blocking web pages generally. An additional action, the Indirect Action of Unconstitutionality (ADI) 5527, has also reached the STF challenging the same lower court order. The two cases before the Supreme Federal Tribunal, ADI 5.527 and ADPF 403, have not been resolved as of December 2022.

Oversight of the Use of Powers (Censorship-related)

LAW 12.965/14 ESTABLISHING PRINCIPLES, GUARANTEES, RIGHTS AND DUTIES FOR THE USE OF THE INTERNET IN BRAZIL (Marco Civil)

Article 20 of Law 12.965 establishes that Internet Application Providers should inform users of the execution of a court-mandated take down order with sufficient information to allow them to legally contest that decision in court, unless otherwise provided by law or in a court order. Furthermore, the user can ask the applications provider to replace the information taken down with an explanatory message or the text of the court order giving rise to the unavailability of the content. However, Articles 19 and 31 provide carve-outs limiting such protections for takedown requests based on copyright infringement.

Publication of Laws and Aggregate Data

Publication of Laws

BRAZILIAN FEDERAL CONSTITUTION

There are no restrictions on the publication of laws in Brazil. All laws are made public pursuant to Articles 5, LX and 37 of the Constitution.

LAW 12.527/11 ON ACCESS TO INFORMATION

Law 12.527 guarantees the access and publicity of public records, including from the Legislative Power (Article 1). In the years preceding publication in October 2022, there have been legal efforts to amend this law via executive decree to allow for greater ability for authorities to identify public information as secret, i.e. decree 9.960/2019, which was later revoked.

RESOLUTION Nº 59 OF NATIONAL JUSTICE COUNCIL

The National Justice Council (“CNJ” – Conselho Nacional de Justiça) has a platform which aggregates information regarding the number of court orders regarding interception and breach of secrecy of communications called the National System of Control of Telephone Interceptions (Sistema Nacional de Controle de Interceptações Telefônicas – “SNCIT”). The information is provided electronically by courts directly to the CNJ, pursuant to article 18 of CNJ’s resolution no. 59, which then publishes the report through SNCIT.