Internet regulation – legislative proposals in Brazil

Sofia Kilmar

TozziniFreire Advogados, São Paulo

skilmar@tozzinifreire.com.br

Guilherme Ribas

TozziniFreire Advogados, São Paulo

gribas@tozzinifreire.com.br

Introduction

Internet regulation is on the global agenda. In the United States, Congress debates revoking the internet safe harbour established in 1996 through section 230 of the US Code, which currently exempts platforms from civil liability for user-generated content. The recent trials of Golzalez v Google LLC and Twitter v Taamneh, by the US Supreme Court on 18 May 2023, fomented the debate in that regard.

In parallel, the European Parliament and the Council of the European Union have recently discussed and adopted the Digital Services Act (DSA), primarily concerning online intermediaries and platforms; and the Digital Market Act (DMA), governing gatekeeper online platforms.

In Brazil, we face a similar scenario concerning debates for a new regulation for the internet. In this article, we describe, from a civil and regulatory law perspective, the status of regulations and bills at Brazilian National Congress.

Civil perspective

From a civil perspective, internet regulation in Brazil is currently grounded on essential norms within the Brazilian civil law (the Constitution, the Civil Code and the Consumer Defence Code), as well as on a specific law for rights and duties on the internet, which came into force in 2014 (the ‘Internet Act’). The Internet Act is a succinct law with 32 Articles establishing:

1. essential principles for the use of the internet in Brazil (such as human rights, diversity, economic freedom, consumers protection, privacy and personal data protection, among others);
2. essential definitions (such as internet connection, connection providers and application providers);
3. rules concerning net neutrality;
4. norms on protection of access logs, personal data and privacy communications;
5. a safe harbour for internet application providers, so that application providers are not liable for user-generated content, unless they disobey a court order for the removal of specific content, or if they disobey an extrajudicial notice for the removal of specific content in which the notifying party is nude or engaging in sexual activity, but did not authorise to be published;
6. rules for provision of access logs for the purpose of identifying people who, at the perception of a judge or public prosecutor, seem to have violated the law when using the internet; and
7. use of the internet by the government.

The public debate on the need of a new internet regulation in Brazil started with discussions on the need to monitor content on the internet for the purpose of avoiding fake news. The main bill of law for a new internet regulation in Brazil, from a civil perspective, is commonly referred to as the ‘fake news bill of law’.

However, the mentioned bill of law covers a wide variety of topics, not only provisions aiming to avoid or reduce the spread of fake news online; it claims to be the new ‘law for freedom, responsibility and transparency on the use of internet’ in Brazil. The bill of law:

1. reinforces principles and goals for the use of internet in Brazil;
2. revokes the safe harbour currently existent in Article 19 of the Internet Act and states that application providers are liable for user-generated content if such content is posted as an advert or is available online as a result of the application provider having failed in the ‘duty of care’;
3. commands application providers to make regular risk assessments on their systems and operation, as well as to change their service as suitable depending on identified risks and to give access to the risks assessments that were made;
4. establishes the ‘duty of care’ as the duty of application providers to act diligently in preventing dissemination of certain illegal contents in their applications, and states that compliance with the ‘duty of care’ will be controlled;
5. draws a ‘security protocol’ for avoiding imminent risks arising from application providers’ activity;
6. establishes a proceeding for the processing of extrajudicial notices requesting content removal, as well as for content removal by application providers in enforcement of terms of services and policies for the use of their applications;
7. establishes a very strong duty of transparency to application providers, including algorithm transparency;
8. establishes the duty of application providers hiring external auditors and publishing external audit reports on the compliance with the law;
9. establishes the duty of application providers providing data to research;
10. regulates online advertising;
11. commands application providers to pay a compensation to copyright owners, concerning copyrighted content posted on the applications;
12. commands application providers to pay a compensation to press companies, concerning content produced by them and posted on the applications;
13. rules the use of the internet by the government;
14. sets guidelines for education on internet use;
15. draws rules for instant messaging applications operating in Brazil; and
16. defines heavy sanctions applicable to application providers, including a fine of up to BRL 50m, the prohibition to treat personal data and temporary suspension of operations in Brazil.

The public debate concerning the bill of law has been very intense and voting sessions have been suspended. The Brazilian National Congress is now discussing new formats for regulating rights and duties for the use of internet in Brazil – for instance including different sections of the above-mentioned bill of law in other existing bill of laws that are awaiting voting, as well as other possible angles for regulating the internet in Brazil.

In parallel, the Brazilian Supreme Federal Court is likely to initiate in 2023 the trial of the leading case on platform’s liability for user-generated content. The subject of the trial is whether Article 19 of the Internet Act, which establishes the internet safe harbour in Brazil, is constitutional or not.

The conclusions of both the Brazilian Congress and the Supreme Federal Court, respectively on the bill of law and on the leading case ruling, will significantly impact the internet regulation environment in Brazil. The impact of such developments surpasses the Brazilian territory, as Brazil is one of the world’s biggest markets for application providers – with a highlight to social network application providers.

Regulatory perspective

From the regulatory perspective, following legislative initiatives from abroad seeking stronger regulation for Big Techs’ activities, in November 2022 Brazilian legislators brought to the table a bill proposal suggesting stronger scrutiny for the activities of digital platforms. Bill of Law 2768/2022 mirrors certain provisions from those set forth in the EU DMA, which entered into force in May 2023. In case approved, the upcoming bill of law will set a new landmark for both the current Brazilian Antitrust Framework and the digital markets.

In general terms, the proposal for the so-called Brazilian DMA provides for the:

• regulation;
• surveillance; and
• application of penalties with respect to activities performed by digital platforms offering services to the Brazilian market.

Special focus is given to gatekeepers, referred to as in the bill of law as ‘digital platforms holding power to control essential access’.

The bill of law foresees the long-established Brazilian Telecommunications’ Agency (ANATEL) as the Brazilian DMA Watchdog, given their expertise in the bill of law’s subject and considering that a substantial part of ANATEL’s ‘pro-competition regulation was based on the obligation of interconnection’. A Digital Platforms Inspection Fund (FisDigi) will be created for gathering financial resources to assist ANATEL’s potential new activities. In addition to resources provided by the Federal Government, gatekeepers will also contribute to the fund by way of a yearly fee amounting to two per cent of their gross turnover.

Significantly impacting data-sharing and application development, DMAs worldwide are the culmination of global concerns regarding the economic power of big techs.

Both Brazilian-like DMA and EU DMA will apply to digital platform services – across eight market sectors – deemed as holding power to control essential access to digital markets, which will include the following:

• online intermediation services;
• online search engines;
• social networks;
• video sharing platforms;
• communication platforms;
• operating systems;
• cloud services; and
• advertising services.

It should be noted, however, that not all digital platforms falling under the above definition should be deemed as ‘gatekeepers’. In Brazil, the digital platform must register annual revenues equal to or greater than BRL 70m in connection with services offered to the Brazilian public.

The Brazilian-like DMA proposal sets certain guiding principles for the activities of gatekeepers in Brazil, such as the following, much likely mirrored from the EC DMA:

1. transparency and duty to provide information on its activities to the regulator;
2. equal and non-discriminatory treatment in the supply of their services (ie, prohibition of self-preferencing practices, such as the leverage of market shares in a vertically related market, considering dominance held by digital platforms in its core business);
3. proper usage of consumers data (ie, the prohibition of digital platforms to combine pieces of information from users without their specific consent); and
4. open access to the platform for consumers (ie, refusal or non-supply may result in sanctions). As the bill of law does not provide for specific commitments for affected parties to comply with the above, ANATEL is expected to issue specific regulations for this purpose.

It should be noted that other authorities in Brazil are already entitled to enforce matters comprised in the bill of law. For instance, the Brazilian Antitrust Agency (CADE) already considers self-preferencing risks both in mergers and investigations, while the Brazilian Data Protection Agency (ANPD) rules over the proper usage of personal data, which also comprise digital platforms.

Non-compliance with the bill shall result in high fines of up to two per cent of net revenue, to be applied on a case-by-case basis.

Conclusion

Although the legislators' intention is not to stifle innovation regarding the digital platforms sector but to promote a fairer and more competitive online ecosystem, the fact is that the current well-established digital platforms started their activities within a significantly less regulated environment, which requires them to adjust to a scenario with (1) newly implemented and also (2) yet to come specific obligations. Within this context, the Brazilian-like DMA proposal comes as a game change among other bills (such as the fake news bill of law described above) and projects under discussion that may affect the current practices of digital platforms significantly.

In this article our goal was to present the Brazilian context on the debate about internet regulation. The subject is globally relevant and has affected and will continue to effect developments in Brazil. We encourage readers to follow up on these further developments and we remain at readers’ disposal for providing additional information on this regard.