The Superior Tribunal of Justice rules that a court order is sufficient for requesting access to online data stored abroad

In March, 2018, the Superior Tribunal of Justice (STJ – the highest court for non-constitutional matters) ruled that in cases regarding breach of secrecy, the email account data stored abroad must be provided despite of any international cooperation, in case one of the members of the same economic group is established in Brazil, since it must comply with the brazilian laws.

The matter arose after a request for breach of secrecy of an email account of Yahoo was made in the course of a police investigation. Based on the Brazilian Internet Act Law (Law no. 12,965/2014), the request for breach of secrecy was addressed to “Yahoo do Brasil”, which has filed an appeal against the decision.

“Yahoo do Brasil” replied the appeal alleging the impossibility of providing the requested data since it was stored abroad. The company pleaded that the requested domain name (“.com”) belonged to Yahoo Incorporated, headquartered in the United States, and argued that since the companies are not the same providers, “Yahoo do Brasil” would be prevented from complying with the court decision.

The Court recognized the unnecessity to establish an international cooperation in the event that the request for breach of secrecy is directed to a company located in Brazil, even if the data is stored abroad, based on Articles 10, section 1 and 11, section 2 of the Brazilian Internet Bill of Rights, which establish the obligation to disclose the content of private communications by a judicial order addressed to the provider responsible for maintaining the data. The provision applies even if it is a foreign-based legal entity, as long as they offer services to the Brazilian public or at least one of the members of the legal entities’ economic group has an establishment in Brazil.

According to the reporting judge, based on the Brazilian Internet Bill of Rights, “Yahoo do Brasil” is not exempt from providing the data requested by the criminal court on the grounds that they are established abroad. The judge also stressed that there is no illegality in the fact that the crime investigated predates the Brazilian Internet Bill of Rights.

STJ’s decision consolidates a practice that is being taking place in Brazil and has already been established in the Brazilian Internet Bill of Rights, regarding the simplification of the data provision requirements so that is not necessary to issue a letter rogatory to foreign countries.

In case of any doubts about this subject, please do not hesitate to contact us.

 

KEY CONTACT
Paula Mena Barreto
Partner
T: +55 21 3262-3028
E: paula.menabarreto@cmalaw.com