The impact of Covid-19 for data protection in Brazil: the perspective of Brazil’s supreme court

Back to Healthcare and Life Sciences Committee publications

Fabio Alonso Vieira

Kestener, Granja & Vieira, São Paulo

fabio.vieira@kgvlaw.com.br

Carolina Barbosa de L. Cunha V da Costa

Kestener, Granja & Vieira, São Paulo

carolina.costa@kgvlaw.com.br

For the first time in the ‘information era’ humankind is fighting an invisible enemy. Since 31 December 2019 when the first case of Covid-19 was reported in Wuhan, China to the World Health Organization, the disease has spread to all continents and quickly became a global health crisis.

In the fight against Covid-19, governments from around the world have adopted various measures of social distancing, quarantine, lockdowns and even the citizen surveillance through smartphones both to identify and to halt the proliferation of the disease and avoid overloading public health services.

The Chinese authorities, for example, are using its citizens’ smartphones to measure body temperatures and medical conditions. This has made it possible for them to identify suspected Covid-19 carriers, track their movements, and identify anyone with whom they may have come into contact.

Google and Apple recently announced a joint effort in the development of an application, which will operate on Android and iOS systems, using the Bluetooth function to identify the proximity of individuals infected by Covid-19 and notify people who have been close to them.

Some might argue that there is nothing revolutionary about these new tracking measures, considering that governments and corporations have been increasingly using sophisticated technologies to track, monitor and analyse peoples’ personal data for several years.

Nevertheless, surveillance measures are always a delicate subject since they inevitably encroach on citizens’ fundamental rights to liberty and privacy. For this reason, on 16 April 2020, the European Commission (EC) published data protection guidelines for the use of mobile applications developed specifically to combat the Covid-19 pandemic. The EC guidelines attempt to limit the use of these technologies, to uphold the fundamental rights of their users.

On 17 April 2020, President Jair Bolsonaro enacted Provisional Measure No 954 (MP 954) which, similar to the Chinese model, requires all telecoms companies that provide telephone services and personal mobile services to share data, such as names, phone numbers, and addresses from their users, with the Brazilian Institute of Geography and Statistics (IBGE), as to allow the IBGE to perform long-distance interviews with Brazilian citizens and improve the accuracy of official statistics during the Covid-19 public health emergency.

Although Brazil’s General Data Protection Law (LGPD) may only come into force in 2021, the data protection debate has already become significant in Brazilian society. Therefore, immediately, after the enactment of MP 954, the Council of the Brazilian Federal Bar Association (CFOAB), Partido da Social Democracia Brasileira (PSDB), Partido Socialista Brasileiro (PSB), Partido Socialismo e Liberdade (PSOL) and Partido Comunista do Brasil (PCdoB) filed a motion claiming unconstitutionality (Judicial Review), with a request for injunction of the MP 954 before the President of the Federal Supreme Court of Brazil (STF).

Each claimant mainly argued that MP 954 violates the personal rights provided in Brazil’s Federal Constitution of personal human dignity, people’s intimacy, private life, honour and image inviolability, data secrecy and informational self-determination.

Furthermore, the claimants also sustained that: (1) MP 954 has a generic scope and imprecise purpose, which is in conflict with the principle purpose set out in article 6, I of the LGPD; (2) when the personal data was collected by the telecoms companies, such data was provided for the provision of telephone services, not for statistical research; (3) there is a lack of explicit urgency and relevance and a lack of necessity for statistical research, whose ultimate use was not disclosed; (4) there is a lack of description of the security measures applicable to the processing of such personal data and data sharing, which is not in compliance with the data quality and security principles provided in LGPD article 6, V and VII; and (5) there is a lack of measures to prevent damages due to the personal data processing not complying with the prevention principles provided for in article 6, VIII of the LGPD.

A few days after the filing of the motion, Minister Rosa Weber granted the preliminary injunction of MP 954, aimed at preventing irreparable damages to citizens’ private lives, and stopping the IBGE from requesting any data provided in MP 954. If such data had already been requested, to suspend the request and to notify the telecoms companies immediately about the decision. The Judicial Review would still be subject to the STF’s plenary analysis and ruling.

In her decision, Minister Rosa Weber highlighted that, in spite of the current public health crisis and the need to create public policies that demand analysis of specific data to fight Covid-19, there is ‘no legitimate public interest’ in telecoms companies sharing their users’ personal data. In addition, the MP 954 does not appear to comply with the ‘purpose, adequacy and minimisation principles proposed in the LGPD’, as it does not define the method and aim of use of collected data.

On 6 and 7 May 2020, the plenary of the STF analysed the ADIs’ and issued an historic decision suspending the effects of MP 954 and acknowledging data protection as an independent fundamental right in Brazil. This means that the protection of personal data is court protected as a fundamental right and shall be considered as other fundamental rights protected by article 5 of Brazil’s Federal Constitution.

The decision rendered by the STF follows the arguments adopted in the trial held by the German Constitutional Court of 1983,^[1] which was the first to establish the concept of informational self-determination. This is the right of the individual to decide what information about themselves should be communicated to others and under what circumstances, and a concept which influences and shapes debates worldwide on data protection issues.

The significance of the informational self-determination principle lies in its flexibility as it is an abstract concept. This means that because it does not have a fixed content, nor is it merely limited to information related to an individual’s intimacy or privacy, it is applicable to various cases involving the processing of information, from the collection to the deletion.

The informational self-determination principal should be analysed under two perspectives: subjective and objective. First, from a subjective perspective, the individual is entitled to have their personal data protected. This means that the state cannot interfere improperly with the fundamental right to data protection. The processing of data is allowed only for purposes established by law and must follow the legal principles, such as transparency and security. Furthermore, there is a need for an authority to monitor and ensure compliance with the law. Second, from an objective perspective, the state is required to ensure the protection of the fundamental right to data protection in public and private transactions.

Considering recent global events, the main concern of STF’s ministers was the risks regarding surveillance. Due to the current pandemic, the processing of personal data may be justified for a few reasons, including some presented by article 7 of the LGPD. However, this processing may end up being enhanced and therefore inevitably limit and/or overcome other fundamental rights.

Minister Rose Weber mentioned in her vote that history has taught us that once surveillance measures are established, there is a significant risk that these measures will not be withdrawn and that the data already processed may be used for different purposes than those for which it was originally collected.

The STF’s plenary follows the same chain of thought as historian and philosopher, Yuval Noah Harari, addressing the dangers of surveillance measures imposed during the Covid-19 pandemic:

‘[…] the epidemic might nevertheless mark an important watershed in the history of surveillance. Not only because it might normalise the deployment of mass surveillance tools in countries that have so far rejected them, but even more so because it signifies a dramatic transition from “over the skin” to “under the skin” surveillance.’^[2]

There are three other important aspects that were analysed during this Judicial Recovery: (1) at the present time, no personal data should be considered as neutral or insignificant; (2) data protection is an independent fundamental right; and (3) the absence of a data protection authority in Brazil and the postponement of the LGPD coming into force.

Considering that many aspects of everyday lives are conducted via smartphones, notebooks and virtual assistants such as Alexa and Siri, Ministers Rosa Weber and Cármen Lúcia mentioned in their votes that any data which leads to the identification of an individual may be used for profiling which has great value for companies and governments (not to mention the Cambridge Analytica scandal) and, therefore, must be protected under the Federal Constitution.

Minister Gilmar Mendes also mentioned in his vote that the vast amount of data collected, processed, and analysed enables governments and companies to use data analytics algorithms and tools, which may promote discriminatory classifications and effect the individual’s social life, for example, with the allocation of opportunities, access to jobs, businesses and other social assets.

As a result, the purpose for which the data is processed and who receives the data is more decisive for the assessment of its constitutionality than the classification of data in private and intimate settings. The challenge then becomes to deciding the criteria used to define the limits of the law and its violations.

Considering that the LGPD has not yet come into force, Ministers Gilmar Mendes and Luiz Fux used the comparative law, notably article 8 of the Charter of Fundamental Rights of the European Union to support their understanding about the unconstitutionality of MP 954 and also on an interpretation of rights provided in Brazil’s Constitution, such as: (1) the fundamental right to the dignity of the human person; (2) the fundamental right to intimacy; and (3) the recognition of the Habeas Data as an instrument of material protection of the right to informational self-determination. Minister Fux also stated that the MP 954 goes against the International Sanitary Regulation, as the latter states that data collection must be proportional to the purpose of the processing.

As understood as an independent fundamental right, Ministers Rosa Weber, Gilmar Mendes and Luiz Fux recognised that the right to data privacy aims to protect a different scope than the right to intimacy and privacy.

With the development of more sophisticated data processing techniques, which bring greater risks to citizens’ personal privacy, data processing gains its own importance. In this sense, one might argue that the fundamental right to data protection entails both a subjective right of defence of the individual and an objective right of duty of protection for the state. This means that from an individual citizen’s perspective, the individual ends up being stripped of some individual liberties but in turn, will not suffer from undue intervention from the state or private power. From the state’s perspective, it is the state’s duty to limit these rights through actions, in order to protect citizens’ rights, even in private relations.

Minister Rosa Weber also referred to the risks provided in MP 954, such as its broadness, the absence of security measures and the excessive collection of data, are greater considering that the LGPD is yet to come into force and the National Data Protection Authority (ANPD) is not operating.

Despite the numerous challenges regarding data protection in Brazil, the STF’s interpretation of the Federal Constitution in face of technological developments, presents itself as a step towards strengthening data protection in Brazil.

Back to Healthcare and Life Sciences Committee publications