Co-authored by: Esther Lins - Brazilian independent lawyer resident in the Netherlands
On April 23, 2014 Law n. 12965/2014, known as the Brazilian Civil Rights Framework for the Internet (in Portuguese: Marco Civil da Internet), was approved by the President of Brazil, Dilma Roussef. The law aims to establish principles, guarantees, rights and obligations concerning the use of the Internet in Brazil and also to provide guidelines for the Public Administration about the matter. The law will come into force by the end of June, 2014.
The Brazilian Civil Rights Framework for the Internet is the result of a couple of years of discussions about the regulation of Internet use in Brazil, which began in 2009. These discussions resulted in Bill 21,626 of 2011, which had some controversial aspects, such as the neutrality and storage of data and the liability of Internet providers for user-generated content.
Some fundamental principles are enshrined in this law, such as the freedom of speech, communication and thought, protection of privacy, protection of personal data, maintenance of the neutrality, stability, safety and functionality of the Web, assignment of liability to agents in accordance with their activities, and freedom of business models promoted through the Internet.
The aforementioned provisions ensure the confidentiality of data, which can only the broken upon a court order. Furthermore, Law 12965 ratifies that the laws concerning consumer protection also apply to consumer relationships established through the Internet.
In regard to the provision of Internet connections and applications, the law ensures the neutrality of the Web, which means that the agent responsible for the transmission, switching or routing of the Internet should treat any data package equally, without distinction as to content, origin and destination, service, terminal or application. The discussions on this aspect of the law were polemic mostly because in Brazil some Internet and mobile companies were offering different service plans to clients, limiting their access, for example, to email and social media only, something that the law now expressly forbids. Any distinction or degradation on the traffic of data shall be only possible by specific regulation approved by the President of the Republic and advice of the Internet Management Committee in cases of technical requirements deemed necessary and prioritizing emergency services.
As mentioned before, the storage of data and availability of connection and access to applications in the Internet, as well as the protection of personal data and private communications, must be preserved to protect the intimacy, private life, honor and image of any person directly or indirectly involved. Therefore, any data allowing user identification is absolutely confidential, except if otherwise ordered by a court.
In the provision of Internet connection, the administrator is required to keep records of all connections in a controlled and safe environment for a period of 1 year. On the other hand, it is forbidden to keep records of access to Internet applications when providing connection services.
For the provision of application services, the service provider is required to keep records of access to applications on the Internet under confidentiality, in a controlled and safety environment, for a period of 6 months.
As regards jurisdiction, this law clearly determines that in any operation of collection, storage and treatment of records, personal data or communication by Internet connection and application providers, the Brazilian law must be followed if any of these operations occur in Brazil. This rule applies even if the operation is conducted by a company or entity headquartered outside Brazil, as long as it offers services to the public in the country, or if at least one company of the same corporate group is headquartered in Brazil.
One of the most relevant matters addressed by the Internet Civil Rights Law is the liability of connection providers for damages arising from user-generated content. The regulation of liability in these cases is very important, considering that in Brazil Internet service providers are often found guilty of hosting content published by users, and such providers usually argued that there are no technical means to control all the content made available in a virtual environment.
The Internet Civil Rights Law determines that the Internet service provider will not be liable for hosting user-generated content, except if, upon a court order, such service provider does not take the appropriate measures to remove this content, within its scope and technical limitations.
Another important rule is that the provider of Internet applications that hosts user-generated content will be subsidiarily liable for the violation of intimacy by disclosing images, videos and other material containing nakedness, private sexual acts, etc. if, once notified by the person involved or his/her agent, it fails to remove such content, within its scope and technical limitations.
The last section of the law is dedicated to establishing the guidelines for the Public Administration to promote and develop the Internet in Brazil, regarding aspects such as technologies, public services, disclosure of public interest data and information, optimization of Web infrastructure, training for internet use, electronic government services, society's participation in public policies, digital inclusion and promotion of digital culture, among others.
This new law has established important rules on how the involved parties and the legal system will treat the different issues regarding the Internet, and hopefully will help both service providers and consumers become aware of their rights, obligations, responsibilities and liabilities arising from relationships in the virtual environment or from the contracting and use of Internet services.