Brazilian court declares data protection a fundamental right in landmark decision
Brazil’s Federal Supreme Court has struck down a government order forcing telecommunications companies to provide access to user information, declaring in the process that data protection is a fundamental right.
Privacy advocates have hailed the judgment has a historic win, but warned that the court’s decision could lead to unintended consequences – by allowing other government agencies to set precedent on data protection issues before the country’s data protection authority is established.
The case stems from Brazil president Jair Bolsonaro’s order last month that would have given the government access to names, addresses, and phone numbers held by telecommunications companies. Brazil’s government said it wanted this information so it could conduct phone interviews – allowing statisticians to practise social distancing – for a survey to determine the economic impact of covid-19.
Bolsonaro’s order was met by multiple challenges, and the Supreme Court temporarily blocked the government’s scheme until it could decide on the programme’s constitutionality.
The court held a two-day hearing over video conference last week in which the objectors argued that the data harvesting would violate the provision in Brazil’s constitution that guarantees privacy rights. They said Bolsonaro’s order was too broad, failed to specify the types of research that will be conducted and did not say how the data would be secured.
In response, Brazil’s attorney general Augusto Aras said the data collection is lawful as it meets the proportionality test – meaning it is adequate and necessary to meet the government’s goal of collecting statistics during the covid-19 crisis, and has provisions that protect privacy.
Aras said the programme is necessary because it allows the government's statistics office to continue its vital task of ensuring that the country can issue quarterly GDP, inflation, employment, and other economic indicators. Among other things, this allows the government to allocate funds to states and municipalities based on their needs, he said.
On Friday, the Supreme Court ruled 10-1 in favour of the objectors, determining that Brazil’s government did not pass the proportionality test. Citing public media reports, the court said the government has already collected some data for its economic survey – a fact that casts doubt on the need for Bolsonaro’s order. The court also noted that the government’s economic reports are usually based on a sample size of about 200,000 respondents, which is only a fraction of the data sought by Bolsonaro.
Thiago Sombra, a partner at Mattos Filho Veiga Filho Marrey Jr e Quiroga Advogados, said a 10-1 ruling is rare and sends a clear message that Bolsonaro’s order extended beyond the government’s authority.
Along with its judgment on the proportionality test, the court also declared data protection a fundamental right – a ruling that surprised some observers.
“The most important aspect of the [court’s] ruling is that it clearly and unequivocally recognized that the right to personal data protection is a fundamental right,” said VMCA partner Marcela Mattiuzzo in São Paulo. “This had never been said before, and it was contested by many – though some had already claimed that such a reading was entirely in line with the development of privacy and walked hand-in-hand with emerging technologies.”
Sombra said nearly every justice cited the incoming omnibus data protection law LGPD in their opinions, which gives the law teeth even though it has not formally come into force and a data protection authority has not yet been appointed.
“The court is embedding the data protection concepts and culture even though the law is not in force yet,” Sombra said. “It’s very clear that if the government doesn’t create the authority, the government may have a lot of losses and problems in court.”
Mattiuzzo warned that the lack of a data protection authority may lead to government bodies imposing their views on the private sector. The data protection authority would presumably allow the private sector to have greater input since it is advised by a body of council members from all sectors of the economy.
“The lack of enforcement of the law leaves space for other authorities to create their own understanding about what data protection is and should be, and to effectively impose their view on the private sector, rather than allowing for the building of a policy alongside the actors directly involved with it, as I believe the LGPD together with the ANPD [data protection authority] could entail,” Mattiuizzo told GDR.
The Supreme Court’s decision is not a conclusion to the matter. Congress still may decide whether it will incorporate Bolsonaro’s provisional measure into law. If it does, then the issues related to the order will continue to be litigated, Sombra said.