Practical problems with the new Brazilian internet law (Marco Civil da Internet) - 2

Please also read: 

Mandatory changes to Internet User Agreements in Brazil

I'm starting a series on Brazilian new Internet Law.  This is the second post. 


I will proceed with some conversations I had just after the law came into force. A longer and more detailed article will follow. 





Dear Adler,

I actually thought about you those days.

We are currently researching questions around data security of cloud services (i.p. e-mail, files) in Brazil for a Germany company who is planning to integrate a Brazilian subsidiary into their IT. We hope to get a project out of it, in which case we would probably also need some legal advise on the topic. E.g. 

- regulations and data protection laws (compared to US/ Europe)

- privacy protection for data transferred to Brazil

- do other international companies use cloud services in Brazil, despite the security problems?

- etc.

Is that an area you are familiar with, so that we could come back to you? 

Best regards,

Edith Cavell

---------------------------------

Dear Edith,

Your consultation comes at a very interesting time. Just yesterday a new law has come into force in Brazil, the Marco Civil da Internet (Internet Civil Regulation). 

Is has basically changed the Brazilian data protection system completely. It has, for example, made Brazilian law mandatory in many cases.

Since this kind of conflict of law situation is my specialty, I'm currently providing consultancy to another foreign company in the matter. 

That said, I would be honored to help you in this situation.  Please tell me more details. I'm also open to a phone call, if you prefer. 

May I post this conversation in my blog, without mentioning names? I'm currently writing a few articles on this subject, since the law is very recent and there is little material about it. 

Regards,

Adler

--------------------------

Hi Adler,

as promised, here is some more background information:

- A Germany-headquarted international company has recently acquired two companies in São Paulo. 

- Now the IT should be integrated, and it is evaluated whether cloud services can be used for email and files (Microsoft Office365). 

- Technical support should be provided from support centers in the EU and/ or USA. For this purpose, personal data from Brazilian employees and customers, stored on servers in Brazil, would need to be accessed from Europe or the US. 

- Sidenote: EU’s data protection laws restrict exporting personal data outside of the EU. Companies must sign detailed EU Standard Contractual Clauses (aka “Model Clauses”) with partners outside of the EU. For data exchange with US-companies, there is also a "Safe Harbour" framework, which e.g. Microsoft has signed.

So here are some questions that come to my mind:

- Do you know whether it is common for international companies to use cloud services in Brazil?

- What are the legal regulations and requirements w.r.t. data protection for using cloud services in Brazil, and exporting personal information to the exterior?

- I have read the new law. What will it mean in practice for a company using cloud services like Office365 in Brazil? Are there other laws and regulations besides the Marco Civil da Internet applicable for this case?

- Are there any standard regulations or contracts between Brazil and the EU or USA (like the "Safe Harbour")?

I am free to talk via phone or e-mail, whatever is more convenient for you. For phone please just let me know when there would be a good time to call you. 

We should also think about a future collaboration, I hope that there will be a project and further advice needed.

Many thanks,

E. C.

---------------

Dear Adler,

just a quick heads up: I will have to finish my research on this topic today.

From what I found out so far, there is no restriction in Brazil for a company saving user data outside of the country. The only difference with the new law seems to be that Brazilian law applies. So that if a Brazilian authority requires the data it has to be available regardless the law of the country where the data is stored.

In case there is anything else you can advise to the topic in addition to that, I would be greatful for a hint.

Thanks for your time and effort!

E.C.

-------------------

Dear Edith,

You are correct. It is possible to save data abroad, but Brazilian law will apply. Not all of Brazilian law, but only some specific privacy provisions brought by the Marco Civil.

But I would add that it is not only the data that must be available,  it must be clear to the government that the company has taken measures not to keep data from Brazilians for longer that the law allows (typically one year). 

Since Brazil does not have jurisdiction abroad, lack of compliance will probably means that Internet providers in Brazil will be forbidden to grant access to the website.  That is, your website or email server could be shut down.

Regards, 

Adler

Practical problems with the new Brazilian internet law (Marco Civil da Internet) - 1

I'm starting a series on Brazilian new Internet Law. 

Please also read: 

Mandatory changes to Internet User Agreements in Brazil

I hope the image ilustrating the post helps explaining what this law really is about: censorhip (and taxes, but we will get there later).

I will start with some conversations I had just after the law came into force. A longer and more detailed article will follow. 









CONVERSATION 1.


Hi Adler - 

Hi hope this finds you well.  I'd like to call an old favor. 

As you may remember, I work for an American National Entity that is very concerned with Internet privacy and internet communications. We have a website available to Brazilians.

We are trying to get a grasp of how the new Marco Civil will impact our business and what changes we need to make (if any). I'm not sure if this falls within your area of expertise. If not, could you recommend someone that we could speak with?

Nick F.

---------

Nick,

You know you can always count on me.

I'm studying the new law right now. I'm focusing on its conflict of law provisions (mandatory application of Brazilian law in some cases) and in its tax provisions. 

We can talk about that if you want. I will also publish a blog post on the next days. 

Regards, 

Adler

---------

Adler,

+ our legal counsell operative, Matt.

Thanks for getting back to me. 

Although we are interested in all aspects of the law (including tax provisions), what we are most concerned about right now (correct me if I'm wrong, Matt) is how this law impacts the collection, use, storage, and process of personal data for which the law seems to state a website needs a users consent. 

Depending on the interpretation of this text, it could make it very difficult for websites to operate in Brazil. Is this something you have a grasp on? Maybe the better question is, does anybody in Brazil have a grasp on the meaning of this? 

FYI - We still do not have a Brazilian entity, but it is something we are considering in the near future. 

Thanks again,

N.F.

-------------------------

Nick,

To be honest, I'm not quite sure. The law is terribly drafted. 

Article 7 institutes heavy limitations on the use of customer's information. 

Article 8 says that the exclusion of Brazilian courts is not allowed in "Internet contracts", but it is not clear if the use of arbitration would circumvent this prohibition. 

Finally, article 11 mandates the use of Brazilian law, basically whenever there is collection of cusomer's information. However, it is not clear if: 

i) arbitration would circumvent this; 

ii) the execution of a separate agreement, specially a commercial one, would be enough to allow for the use of a foreign law;

iii) if this has any practical application, since:

  a) it is not probable that Brazilian will choose local courts to sue foreign-based companies and web sites.  and

  b) Brazilian general conflict of law rules would indicate a different approach, and it is not clear which rule (the general ones or this one) will apply in a determined case

Also, the law mentions that registers of the use of the information by foreign applications must be maintained by local service providers in Brazil. I suppose this is aimed at big Telecom or phonecompanies that sells apps in Brazil, inter alia. 

But I'm not sure how this would translate to mass markets if you take the use of internet via desktops into account. 

I'm open to discuss this matter over the phone, without cost.  In case you feel you need a legal opinion, we can discuss that. 

May I publish this conversation in my blog, without mentioning your name? This would help a lot. 

Regards, 

Adler
-------------------------

Correct

We need to understand what qualifies as a "user" ?  Someone who merely "uses" or site without registering with an account, or someone who registers with our site only (where we can get an "agreement" to some extent)

We need to understand what PI is for such casual users, and for registered users.

We need to understand cookies on users.

But yes.  This law on its face seems difficult if not impossible to comply with.

Matt M.