Newsletter IP and Data Protection | June 2020

STF SUSPENDS THE EFFECTIVENESS OF MP THAT PROVIDED FOR THE SHARING OF PERSONAL DATA WITH IBGE

In May, the Plenary of the Brazilian Federal Supreme Court (STF) confirmed the injunction granted by Justice Rosa Weber to suspend the effects of the Provisional Measure (MP) 954/2020 and, thus, recognized an autonomous fundamental right to personal data protection.

Such MP required telecommunications operators to share data from their consumers, individuals and legal entities, such as names, telephone numbers and addresses, with the Brazilian Institute of Geography and Statistics (IBGE), to maintain the continuity of researches, previously carried out in-home visits, during the coronavirus pandemic.

The lawsuits were five Direct Unconstitutionality Actions (ADIs) filed by political parties opposed to the government and by the Federal Council of the Brazilian Bar Association (OAB), against the provisional measure, alleging mainly violation of the provisions of the Federal Constitution that ensure the dignity of the human person, the inviolability of intimacy, private life, honor and image of people, the confidentiality of data and informational self-determination.

On the other hand, in favor of the MP, the Attorney General’s Office (AGU) and the Office of the Prosecutor General (PGR) defended that the data that would be shared are considered simple and potentially public, as well as those contained in the old telephone directories. The AGU also added that it would be enough for the citizen to refuse participation in the research when contacted by IBGE. The PGR argued that the Constitution ensures the inviolability of communication, and not the inviolability of data, and that the fact that the pandemic context does not have an end forecast requires exceptional measures, which allows fundamental freedoms to be comprehensively restricted.

However, several exhibitors, in addition to Justices Gilmar Mendes and Cármen Lúcia, cited that, currently, personal data, such as the telephone number, are the key to access many popular applications, and may even be manipulated to influence behaviors. Thus, according to the rapporteur, as any data that leads to the identification of a person may be used for the formation of informational profiles of great value for the market and the State, constitutional protection is necessary.

The Supreme Court then, faced with the risk of irreparable damage to millions of Brazilians, by majority vote, decided to suspend the MP, establishing the understanding that such sharing violates the constitutional rights to privacy, private life and data confidentiality, provided for in art. 5, items X and XII, of the Federal Constitution. Although they are not absolute, these rights can only be relativized with the observance of the principles of reasonableness and proportionality, which did not occur in the case of the MP, as highlighted by Justice Alexandre de Moraes.

In sum, the Justices agreed that the MP does not define the object of the statistics to be produced, nor the specific purpose, nor the extent. Another point mentioned was that there would be excessive data collection (more than 200 million), in an amount much higher than necessary to conduct sample research (about 70 thousand households per month are normally consulted, according to IBGE itself), infringing the principles of adequacy and necessity foreseen in the General Data Protection Law (LGPD).

They also added that the MP does not establish any technical or administrative security mechanism to protect the shared data, in order to prevent accidental leaks or misuse. Thus, without providing for minimum safeguards to guarantee the privacy of telephone service users in Brazil, the protection of fundamental rights is at risk.

It is important to emphasize that, although the effects of the MP are suspended, its processing continues in Brazilian Congress, where there will be a vote on its conversion or not into law until August 3, 2020.

Finally, this decision is considered historic, as it produces binding legal effects and expresses the constitutional protection of personal data, whose shelter is now recognized as a fundamental right, supported by the protection of privacy, human dignity and the guarantee of habeas data. However, it goes far beyond that, since, from this recognition, the scope of protection is expanded: there is constitutional support not only for intimate or private data but for any personal data.

Given a scenario in which, although approved, the LGPD is not yet in force and there is no independent authority in the country, it is extremely important to have these parameters to base and strengthen data protection in Brazil.

In case of any doubts about this subject, please do not hesitate to contact us.

CONTACTS:

Paula Mena Barreto
Partner
T: +55 21 3262-3028
E: paula.menabarreto@cmalaw.com

Manoela Esteves
Associate
T: +55 21 3262 3042
E: manoela.esteves@cmalaw.com

Thaissa Lencastre
Associate
T: +55 21 2217-2041
E: thaissa.lencastre@cmalaw.com

Ana Luisa Bastos
Associate
T: +55 21 2217-2049
E: ana.bastos@cmalaw.com