Google Brazil fined for not disclosing suspect's Gmail accounts to the police

Folha, a Brazilian newspaper, has informed (link here) that Google Brazil has been fined for not complying with a judicial ruling commanding it to allow Brazilian investigators to access  suspect's Gmail accounts. 

The judge would have made use of general procedural powers and also of the new Brazilian Internet Law (Marco Civil da Internet). 

Google Brazil reportedly claimed that the messages were stored in the USA, and that some sort of cooperation between Brazilian and American authorities would be required. 

I think this is a good example of the problems with Marco Civil da Internet. Were the messages  physical ones (as in a piece of paper) instead of  electronic ones, international judicial cooperation would be required. But Marco  Civil has allowed Brazilian authorities to essentially extort and coerce foreign companies to comply with order that are ilegal abroad (and sometimes also in Brazil, since disclosure of correspondence is not an easy topic in our jurisprudence).

Please see previous comments on the Marco Civil here.

Brazil bans privacy apps

This an article of mine published by Alternative Emerging Investor magazine. It describes the recent controversy over secret message-exchanging apps, which have been ruled ilegal in Brazil. Please check the full content at http://www.aeinvestor.com/ Copyright © 2013 Alternative Emerging investor Inc. All Rights Reserved.

Mandatory changes to Internet User Agreements in Brazil

Brazil internet law has come into effect. Just the other day.  You may find the bilingual text here (from 
The Geneva Internet Platform).

Any internet company, any company that distributes software or apps,  and basically any company that has a web page that can be used by Brazilians, will be forced to adapt its User Agreements and privacy policies to the new law. 

The government is expected to publish a decree detailing the expected changed. But, from the text of the bill, we can make some assumptions. 

This will be a very short list. You will find more detailed comments at http://www.privacylatam.com


i) Terms of Use offered to a broad public will automatically be subject to Brazilian consumer protection rules;
i.a) privacy protection rules shold always follow Brazilian law, whenever the access is made from Brazil (but not when a Brazilian access the website from abroad);
ii) It is mandatory to offer Brazilian forum as one of the options for litigation forum (it is not clear if this prevents arbitraitons, or if arbitration must be placed in Brazil);
iii) You can't sell user information to data collection companies or for publicity purposes, unless there is express and specific approval from the user;
iv) agreements shoul be made through special entities, detached from the main group, in order to avoid fines applicable to any company of the group;
v) sharing user's emails or other information with security agencies from other countries, without prior authorization from Brazilian courts, becomes illegal;
vi) permanent exclusion of all user's information should be allowed, upon request;
vii) companies must be ready to provide basic info on the user to criminal prosecutor, even in the absence of a court decision (the constitutionality of this provision is disbutable);
viii) user agreement must be written in easy and accessible language (it is not clear if it means clear Portuguese or if a clear English text will do). 


Please read my other posts on this matter:

Practical problems with the new Brazilian internet law (Marco Civil da Internet) - 1

Practical problems with the new Brazilian internet law (Marco Civil da Internet) - 2

Repercussions of Brazilian internet Law on international agreements with Brazilian users.

I will keep you posted as the subject develops. 

Practical problems with the new Brazilian internet law (Marco Civil da Internet) - 1

I'm starting a series on Brazilian new Internet Law. 

Please also read: 

Mandatory changes to Internet User Agreements in Brazil

I hope the image ilustrating the post helps explaining what this law really is about: censorhip (and taxes, but we will get there later).

I will start with some conversations I had just after the law came into force. A longer and more detailed article will follow. 









CONVERSATION 1.


Hi Adler - 

Hi hope this finds you well.  I'd like to call an old favor. 

As you may remember, I work for an American National Entity that is very concerned with Internet privacy and internet communications. We have a website available to Brazilians.

We are trying to get a grasp of how the new Marco Civil will impact our business and what changes we need to make (if any). I'm not sure if this falls within your area of expertise. If not, could you recommend someone that we could speak with?

Nick F.

---------

Nick,

You know you can always count on me.

I'm studying the new law right now. I'm focusing on its conflict of law provisions (mandatory application of Brazilian law in some cases) and in its tax provisions. 

We can talk about that if you want. I will also publish a blog post on the next days. 

Regards, 

Adler

---------

Adler,

+ our legal counsell operative, Matt.

Thanks for getting back to me. 

Although we are interested in all aspects of the law (including tax provisions), what we are most concerned about right now (correct me if I'm wrong, Matt) is how this law impacts the collection, use, storage, and process of personal data for which the law seems to state a website needs a users consent. 

Depending on the interpretation of this text, it could make it very difficult for websites to operate in Brazil. Is this something you have a grasp on? Maybe the better question is, does anybody in Brazil have a grasp on the meaning of this? 

FYI - We still do not have a Brazilian entity, but it is something we are considering in the near future. 

Thanks again,

N.F.

-------------------------

Nick,

To be honest, I'm not quite sure. The law is terribly drafted. 

Article 7 institutes heavy limitations on the use of customer's information. 

Article 8 says that the exclusion of Brazilian courts is not allowed in "Internet contracts", but it is not clear if the use of arbitration would circumvent this prohibition. 

Finally, article 11 mandates the use of Brazilian law, basically whenever there is collection of cusomer's information. However, it is not clear if: 

i) arbitration would circumvent this; 

ii) the execution of a separate agreement, specially a commercial one, would be enough to allow for the use of a foreign law;

iii) if this has any practical application, since:

  a) it is not probable that Brazilian will choose local courts to sue foreign-based companies and web sites.  and

  b) Brazilian general conflict of law rules would indicate a different approach, and it is not clear which rule (the general ones or this one) will apply in a determined case

Also, the law mentions that registers of the use of the information by foreign applications must be maintained by local service providers in Brazil. I suppose this is aimed at big Telecom or phonecompanies that sells apps in Brazil, inter alia. 

But I'm not sure how this would translate to mass markets if you take the use of internet via desktops into account. 

I'm open to discuss this matter over the phone, without cost.  In case you feel you need a legal opinion, we can discuss that. 

May I publish this conversation in my blog, without mentioning your name? This would help a lot. 

Regards, 

Adler
-------------------------

Correct

We need to understand what qualifies as a "user" ?  Someone who merely "uses" or site without registering with an account, or someone who registers with our site only (where we can get an "agreement" to some extent)

We need to understand what PI is for such casual users, and for registered users.

We need to understand cookies on users.

But yes.  This law on its face seems difficult if not impossible to comply with.

Matt M.