UPDATED: December 2017 | SOURCE: Telecom Industry Dialogue with support from Hogan Lovells
Provision of Real-time Lawful Interception Assistance
The inviolability of private communications in Brazil is established in several pieces of legislation.
BRAZILIAN FEDERAL CONSTITUTION
Paragraphs IX, X and XII of Article 5 of the Brazilian Constitution protect the freedom of speech, the right to privacy, and the secrecy of private communications in Brazil.
Article 5, XII states that the secrecy of correspondence and of telegraphic data and telephone communications is inviolable except, in the latter case, by court order in the circumstances and manner prescribed by law for the purposes of criminal investigations or proceedings.
LAW 9.472/97 ORGANIZATION OF TELECOMMUNICATIONS SERVICES, THE CREATION AND OPERATION OF A REGULATORY BODY AND OTHER INSTITUTIONAL ASPECTS
Under Article 3, users of telecommunications services are entitled to the inviolability and secrecy of their communications (except where set out by law) and respect for their privacy in the collection of documents and in the use of personal data by communications service providers (“CSPs”).
LAW 9.296/96 REGULATING ARTICLE 5, XII OF THE CONSTITUTION
With regard to obtaining evidence for criminal investigations through telephone interception, the police (in the course of a criminal investigation), or the Federal or State Public Prosecutor’s Office (in the course of an investigation or criminal proceedings) may request authorisation from the court. Under Article 2 of Law 9.296/96, in order for such evidence to be validly obtained:
(a) there must be a reasonable suspicion that the alleged perpetrator has committed a crime;
(b) there must be no other means available for producing the evidence of the alleged crime; and
(c) the alleged crime must be punishable by imprisonment.
If these criteria are met, Article 3 requires that a court must authorise the interception (in accordance with the CPC, as set out below).
Under Articles 6 and 7, the authority authorised to perform the interception may require that CSPs provide specialised technicians and services to aid in the interception. The authority which requested the interception has primary responsibility for the investigation but may delegate responsibilities to the personnel of CSPs who must in turn pass any information obtained through the interception back to the relevant authority.
Under Article 10, it is a crime to intercept telephone, computer or telematic communications or breach judicial secrecy without judicial authorisation or for purposes not authorised by law.
Article 154-A of the Criminal Code also criminalises invasion of computer/mobile devices to obtain data without due judicial authorisation.
DECREE-LAW 3.689/41 CRIMINAL PROCEDURE CODE (“CPC”)
Pursuant to Article 156 CPC, courts may order the production of evidence by means of interception when the requirements set out in Article 2 of Law 9.296/96 (as set out above) are met.
The court must oversee the interception process and determine to what extent the information gathered can be used in an investigation or criminal proceeding and must determine the timeframe during which communications may be intercepted. Article 5 of Law 9.296/96 states the interception order can last up to 15 days (renewable for further 15 day periods in extraordinary circumstances where it is proved that it is indispensable for the investigation).
Pursuant to Article 8.2(h) of the Inter-American Human Rights Convention and Article 5, XXXV of the Brazilian Constitution, any court decisions that threaten or harm constitutional rights may be appealed to a court of higher instance.
LAW 12.965/14 ESTABLISHING PRINCIPLES, GUARANTEES, RIGHTS AND DUTIES FOR THE USE OF THE INTERNET IN BRAZIL
Article 7 guarantees certain rights for internet users, including the inviolability and secrecy of communications over the Internet except by judicial order in accordance with the law.
Under Articles 10 and 22 there are similar requirements for interception of communications over the internet to those required for telephone communications. The interested party may request that the court order the custodian to provide connection records or access records to applications. The application for such an order must contain:
(a) well-founded evidence of the occurrence of the offence;
(b) reasoned justification of the usefulness of the records requested for purposes of the investigation for evidence; and
(c) the period to which the records refer.
OTHER OBLIGATIONS ON CSPS
The Brazilian National Agency for Telecommunications (“ANATEL”) has the authority to regulate and monitor CSPs in Brazil.
Pursuant to Article 90 of Resolution 477/07 and Article 24 of Resolution 426/05, both fixed and mobile telephone service providers must make available to the court all technological resources required to access private communications and conduct interceptions. Service providers must bear the financial costs of this technology.
Disclosure of Communications Data
CSPs are obliged to retain metadata generated by internet connections for one year under Article 13 of Law 12.965/14.
ANATEL’s Resolutions 426/05, 477/07 and 614/13 also require that CSPs store metadata relating to landlines and mobile phone services for five years.
No specific legislation governs access to such metadata but access can be granted through court orders to produce evidence. Government authorities, including both law enforcement and administrative agencies, may require CSPs to disclose customer data pursuant to judicial orders such as search and seizure warrants, direct disclosure orders or interception orders. A similar procedure applies for interception; namely, that the authorities must file for an order of disclosure with the court in the course of criminal investigations or proceedings, which will then analyse the legitimacy of the request pursuant to the requirements of Article 156 CPC.
The court that ordered the production of evidence must oversee the process of obtaining the metadata and determine to what extent the information gathered can be used in an investigation or criminal proceedings.
Pursuant to Resolutions 477/07 and 426/05, ANATEL may access billing documents including call records and personal account information by simply requesting access from CSPs. Pursuant to Article 38 of Resolution 596/12, CSPs must provide ANATEL with the data it requests. There is currently an online system in place which allows for direct and unlimited access to this information on CSPs’ internal systems by ANATEL for any purpose.
National Security and Emergency Powers
Law 9.883/99 created the Brazilian Intelligence Agency (“ABIN” – Agência Brasileira de Inteligência) and the Brazilian Intelligence System (“SISBIN” – Sistema Brasileiro de Inteligência). ABIN is a body within the Office of the President, whereas SISBIN is an integrated system of governmental agencies and authorities which provide information to the President of the Republic on matters of national interest, pursuant to Article 1.
Under Article 3, ABIN plans, executes, coordinates, supervises and controls all intelligence activities in Brazil in accordance with the requirements set out therein. ABIN is also entitled to request cooperation from other agencies through SISBIN pursuant to Articles 6, V and 6-A of Decree 4.376/02.
ABIN does not have the authority to conduct interceptions independently. Under Article 6 of Law 9.296/96, the police have exclusive authority to perform interceptions. However, ABIN may seek a court order requiring the police to intercept personal data at ABIN’s request.
ABIN cannot demand information such as communications metadata directly. However, as it is the operator of the SISBIN, ABIN may access data in possession of members of the SISBIN (Articles 6, V and 6-A of Decree 4.376/02).
Article 6 provides for external control and monitoring of ABIN by a commission instituted by Congress’ Mixed Commission of Intelligence Activities Control (“CCAI”- Comissão Mista de Controle das Atividades de Inteligência). CCAI has been assembled on few occasions and only in relative emergencies.
Under the Constitution, the right to secrecy of communications may be restricted if the President of the Republic institutes: (i) a state of national defence, pursuant to Article 136.1, I (b)(c); or (ii) a state of war, pursuant to Article 139, III. While a state of national defence can be directly instituted by presidential decree, the institution of a state of war is subject to Congressional approval.
It is at the President’s discretion to define in his or her decree of a state of national defence the extent of the restriction on the right to secrecy of communications. Pursuant to Article 136 of the Constitution, a state of national defence is a broader state of extraordinary legality and legitimacy that may be constituted whenever there is grave disturbance to public order and social peace, or when there is a natural catastrophe of large proportions.
Congress provides oversight over the institution of states of national defence or war pursuant to Articles 136 and 137 of the Constitution. Moreover, the Supreme Court has jurisdiction to review the establishment of the state of national defence or of war.
Under Articles 7, III and 10(2) Law 12.965/14, courts may restrict access to certain applications where the website’s content is illegal (such as, for example, child pornography)(following the case of REsp 1308830 / RS decided by the Brazilian Court of Justice) or where the relevant service providers deny the Brazilian authorities access to users’ data, provided the aforementioned criteria set out by the CPC are fulfilled.
A recent preliminary decision from the Brazilian Supreme Court (“STF”) overturned a court order restricting access to the WhatsApp application nationwide. Justice Lewandowski stated that this order was disproportionate and threatened the freedom of speech. The lawsuit was proposed by the Popular Socialist Party (“PPS”) as an injunction under Law 9.882/99, and the STF decision is pending.
Pursuant to the injunction filed by PPS, the STF convened a public hearing to discuss the constitutionality of court orders blocking the WhatsApp application. This hearing also discussed the constitutionality of court orders blocking webpages. The hearing took place on 5 June 2017. The STF has not yet issued its final decision.
Publication of Laws and Aggregate Data
PUBLICATION OF LAWS
There are no restrictions on the publication of laws in Brazil. All laws are made public pursuant to Articles 5, LX and 37 of the Constitution.
PUBLICATION OF AGGREGATE DATA
The National Justice Council (“CNJ” – Conselho Nacional de Justiça) has a platform which aggregates information regarding the number of court orders regarding interception and breach of secrecy of communications called the National System of Control of Telephone Interceptions (Sistema Nacional de Controle de Interceptações Telefônicas – “SNCIT”). The information is provided by courts by electronic means directly to CNJ, pursuant to article 18 of CNJ’s resolution no. 59, which then publishes the report through SNCIT.
Law stated as of 12 December 2017.