Case Summary and Outcome

The Brazilian Superior Court of Justice (STJ) ruled that forcing the disclosure of confidential data of social network users who merely shared a fake video would violate the right to privacy. A video posted anonymously on Facebook, which falsely claimed the presence of larvae in a snack sold by a bakery, led to investigations by public health authorities and in financial losses and reputational damage to the bakery. The bakery sued Facebook requesting that the company immediately suspend the dissemination of the video, and disclose the identities of those responsible for its posting, as well as of those who shared it. The lower courts granted the request for the disclosure of user access logs to those who allegedly shared the video, as they found signs of illegal activity involving the dissemination of defamatory information. The STJ, however, emphasized the importance of the right to privacy and dignity within Brazil’s legal framework governing internet usage. It held that it was disproportionate to infringe the privacy rights of those users who merely shared the video, and it would constitute an “indiscriminate breach of confidentiality” if those users’ details were identified and disclosed to the bakery.

---

Facts

On April 28, 2016, the Brazilian community Facebook page “BC da Deprê” (a humorous page for the city of Balneário Camboriú, or BC, directly translated as BC’s depression) shared a video titled “Snack purchased at Big Pan bakery in Barra neighborhood, if you’ve just eaten or are currently eating, do not watch this video”. The video, posted anonymously, falsely claimed that a snack purchased from the Big Pan bakery in Balneário Camboriú, Santa Catarina, Brazil had contained larvae. However, the snack did not contain lavae and had not been purchased from the Big Pan bakery. The video gained widespread attention in the city and led to Public Health Surveillance inspecting the bakery, which in turn caused suppliers to terminate multiple contracts.

Given the financial impact and reputational damage, Big Pan bakery filed a lawsuit against Facebook. They requested that the company immediately suspend the dissemination of the video, preserve the connection records of the “BC da Deprê” page, and provide all necessary elements for identifying the party responsible for the disclosure.

After discovering that a former employee had also subsequently shared the video, the bakery also requested the removal of the new video, as well as the IP addresses of all users who shared the post.

On May 6, 2016, Judge Rodrigo Coelho Rodrigues of the 4th Civil Court of Balneário Camboriú issued a preliminary decision. He found that while the right to freedom of expression is a pillar of democracy and essential for the maintenance of the republican system, it “is not absolute and cannot serve as a justification for injuring, defaming, or slandering third parties”. [p.  49] Judge Rodrigues concluded that there was “excess” on the part of those responsible for the “BC da Deprê” page, causing irreparable damages to the bakery. Although he acknowledged that commercial practices are subject to criticism, even unjust ones, Judge Rodrigues concluded that the publication “is capable of causing irreparable damage to the company if its veracity is not confirmed and it indeed proves to be a bad-faith denunciation by third parties”. [p. 50] As the video was no longer available on the page at that time, the Judge ordered Facebook to provide the identification of the individual responsible for the publication and the administrators of the “BC da Deprê” page, as well as the IP addresses of all who shared the video.

In a subsequent decision, issued on May 23, 2016, Judge Rodrigues ordered the suspension of the video’s dissemination on the former bakery employee’s page. Additionally, Facebook was ordered to provide the identification of the individual responsible for the publication, including their IP address.

On November 30, 2019, after due process, the preliminary decision was fully confirmed by the same court.

The bakery appealed, arguing that although the suspension of the video was ordered, the Judge of the first instance had not ruled on the obligation to present reports regarding the identification of the users of the page. Furthermore, the bakery argued that the Judge did not impose a fine if Facebook failed to comply with the decision.

On April 16, 2019, the Sixth Civil Chamber of the Court of Justice of Santa Catarina delivered its decision.

Based on Article 22 of the Brazilian Civil Rights Framework for the Internet, Judge Denise Volpato, followed by Judges Stanley Braga and André Carvalho, granted the request for the disclosure of user access logs to those who allegedly shared the video, as they found signs of illegal activity involving the dissemination of defamatory information. Moreover, she concluded that, under Article 13 of the same law, Facebook has the legal duty to store and disclose the information sought by the bakery. Judge Volpato said that there was no illegality in this measure on the grounds of a possible invasion of privacy or intimacy of the users because “sharing information and posts from a public profile of a humorous nature does not represent an inherent aspect of the users’ personality or private life”. [p. 10] According to the Judge, sharing a publication from the Facebook page “BC da Deprê” is “trivial content, not correlated to any deeply personal interest of the potential sharing users”. [p. 10] The Judge imposed a fine of R$ 500.00 (five hundred reais) per day, limited to a total of R$ 50,000.00 (fifty thousand reais), if Facebook failed to comply with the court orders.

Facebook appealed to the Superior Court of Justice against this decision.

---

Decision Overview

On March 9, 2021, Justice Luis Felipe Salomão, of the 4th Panel of the Superior Court of Justice (STJ), delivered the final decision.

The central issue for the Court was whether it was permissible to breach the confidentiality of all users who shared a video with potentially defamatory content on the Facebook platform, provided that the URL was indicated. The applicable law encompasses Article 5, X and XII of the Federal Constitution, which establish the rights to personality and data secrecy, and Article 22 of Law 12.965/2014 – the Brazilian Civil Rights Framework for the Internet which addresses exceptional cases in which the provider must provide connection records or access records to internet applications.

Facebook argued that the order to provide records of all users who shared the video without having indicated the respective URLs to be provided violated Article 19, §1, of the Civil Rights Framework for the Internet. Additionally, it submitted that this order created legal uncertainty and rendered compliance with the data supply order unfeasible. Facebook argued that the absence of URL indication poses the risk of breaching the confidentiality of third parties, violating privacy, and improperly identifying individuals as responsible for illicit expressions for which they were not accountable. The company also argued that it could not be presumed that every sharing of the content in question would imply the commission of an offense under penalty of endorsing generic and collective orders for the provision of internet user data.

Justice Salomão examined the scope of Article 22 of the Marco Civil Law of the Internet, Law No. 12.965/14. This article allows parties involved in civil or criminal proceedings to request a judge to order the custodian to provide connection logs or access logs to internet applications as part of forming an evidentiary set. The Judge emphasized that the law requires the requesting party to provide evidence of the offense, justify the relevance of the requested records for investigation or evidence purposes, and specify the period to which the records refer. [p. 10]

Discussing the “information society”, the Justice acknowledged that there has been an expansion of new standards of social behavior, “where a new archetype of interaction among individuals is formed in the space known as cyberspace”. [p. 14] He added that the large amount of data with personal information available on the network (big data) “has brought numerous benefits to society as a whole, generating wealth and social progress” but that it also “has brought into question the private life of users in the face of possible violations of personality rights, as well as the advancement of freedom of expression and monitoring of information in the digital realm”. [p. 14]

Justice Salomão noted the many normative devices that have been established in Brazil to protect citizens and informational self-determination, such as the Civil Rights Framework for the Internet (Law No. 12.965/2014), the General Personal Data Protection Law (Law No. 13.709/2018), and the Positive Registry Law (Law No. 12.414/2011, with amendments by Complementary Law No. 166/2019). [p. 15]

Quoting international frameworks, Justice Salomão highlighted Article 35 of the Portuguese Constitution, which elevated the right to informational self-determination to the status of a fundamental right, and Directive 95/46/EC of the European Commission, which gave rise to the General Data Protection Regulation (GDPR) (EU 2016/679). [p. 15]

He also emphasized that the main law under discussion in this case, the Civil Rights Framework for the Internet, was inspired by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and was “conceived after long debates between the government and civil society, understood as the first Brazilian legislation aimed at guiding rights and duties in the virtual environment”. Quoting Article 3 of the Civil Rights Framework for the Internet, Justice Salomão stated that its main principles are respect for freedom of expression, privacy, data protection, and network neutrality. [p. 15]

Justice Salomão stressed that safeguarding the right to privacy and freedom of expression, as outlined in Article 8 of this law, is crucial for enabling full internet access. Accordingly, ensuring privacy and personal life means refraining from disclosing personal data, such as connection logs and access to internet applications, to third parties, except with free, express, and informed consent or as mandated by law. [pp. 15-16]

He also outlined key cases adjudicated by the STJ regarding the responsibilities of internet service providers. For instance, he referenced REsp 1512647/MG (May 13, 2015) where the Court held that internet service providers bear responsibility in cases of intellectual property violation if they intentionally induce or encourage third parties to commit unlawful acts directly, and Rcl 5.072/AC (December 11, 2013) where the STJ ruled that virtual search providers are not obliged to remove search results derived from specific terms or expressions from their systems. [pp. 16-17] He also referred to other important judgments from the Second Section of the STJ: in REsp 1406448/RJ (February 6, 2018), where it was decided that preventive removal of illegal or offensive messages hinges on the complainant indicating the URL of the page; in REsp 1306157/SP (December 17, 2013), the Court held that internet service providers must identify authors of illicit content (IP address); in REsp 1316921/RJ (June 26, 2012), it held that search engine providers cannot be forced to remove specific search results, irrespective of URL indication and, similarly, in REsp 1568935/RJ (April 5, 2016), that internet content providers’ responsibility hinges on editorial control over the material. [p. 17]

With reference to the case REsp 1738628/SE (February 19, 2019), Justice Salomão reiterated that “the requirement for precise indication of the URL aims at identifying the content intended for removal, thus ensuring freedom of expression, and preventing prior censorship by internet application providers”. However, he noted that “in cases where the illegality of the publication is blatant, with the potential to cause serious personal, social, and professional harm to the author’s image, the actions of the parties involved in the process (judge, plaintiff, and defendant) must occur swiftly, effectively, and collaboratively, through the conjunction of efforts seeking to minimize, to the greatest extent and in the shortest time possible, the harmful effects of the material identified as infringing”. [pp. 17-18] Quoting the case REsp 1660168/RJ (May 8, 2018), he highlighted exceptional circumstances in which “the punctual intervention of the Judiciary is necessary to sever the link created, in the search engine providers’ databases, between personal data and search results that are not relevant to the public interest in information, either due to the predominantly private content or the passage of time”. [p. 18]

Finally, concerning the right to compensation, Justice Salomão cited the conclusion of the case REsp 1642997/RJ (September 12, 2017), where the STJ decided that “moral damage resulting from messages with offensive content posted on the website by the user does not constitute an inherent risk of the activity of video-sharing providers”. [p. 18]

Regarding the present case, Justice Salomão noted that the controversy is different from those already decided by the Court, as it required a determination of whether the disclosure of connection and access records is necessary to identify users who merely shared a video with potentially defamatory content on the Facebook platform. [pp. 18-19] He emphasized that “any interpretation of the dictates of the Civil Rights Framework for the Internet must always occur in light of the constitutional framework of personality rights, as a constitutive guarantee of fundamental rights, expanding human dignity over the aforementioned microsystem”. [p. 19] Citing the judgment of RE n. 1.010, he added that “any excesses or abuses in the exercise of freedom of expression and information must be analyzed on a case-by-case basis, based on constitutional parameters – especially those related to the protection of honor, image, privacy, and personality in general – and the express and specific legal provisions in the criminal and civil spheres”. [p. 19]

Reflecting on the right to expression in contrast to personality rights, Justice Salomão argued that “while it is true that social media users can freely assert their fundamental right to expression, it is also correct to maintain that their freedom will find limits in the personality rights of others, under penalty of abuse of their autonomy, since no right is absolute, no matter how preferred it may be, especially when it comes to damage to other rights of high importance”. [pp. 19-20] He added that the breach of confidentiality is an extremely sensitive element in the field of personality rights, and therefore, “the fulfillment of the authorizing requirements must be done meticulously, with effective indications of illicit conduct being minimally characterized, with a case-by-case analysis of the necessity of the measure, because, it must be reiterated, we are dealing with values ​​that are very dear to society”. [p. 21]

Accordingly, Justice Salomão defended the prioritizing of the right to privacy over the right of the offended party to access all data related to the post in the present case, stating that “in a balancing of values, the personality rights of the users are more vulnerable.” [p. 22] He added that, since the bakery, as the appellant, failed to provide any indications of unlawfulness in the conduct of users who merely shared the video with defamatory content, it was deemed unreasonable to treat all other users who saw the false news and shared its content as the true authors of the wrongful act. Accordingly, Justice Salomão stated that “the order of the lower court – in a generic and collective request, without the minimum specification of an unlawful conduct performed – regarding the indiscriminate provision of data from all users who shared the post, is disproportionate […]”. [p. 22]

Citing Decree No. 8,771, dated May 11, 2016, which regulates the Civil Rights Framework for the Internet, Justice Salomão stated that, regarding requests for registration data, the law expressly prohibits collective requests that are generic or unspecific, exactly as occurred in the present case. [pp. 22-23]

Justice Salomão concluded that merely sharing the fake video cannot warrant violating the fundamental right to data privacy: “[i]t is not possible to deduce and presume wrongdoing from all those who shared the post – selling pastries with larvae – to the extent of relativizing their privacy, intimacy, and data secrecy, thus dismissing, outright, those users who, in good faith, believing in the reported account, shared the video out of legitimate concern for other customers, or conversely, those who shared it as a form of condemnation of its untrue content, or even those who simply shared it without making any value judgment”. [p. 23] He recalled the case Resp No. 1512647/MG, where the court decided that “[c]omplying with the obligation as determined would result in the provision of personal data and IPs of the entire list of users of the mentioned communities, unjustifiably breaching their respective confidentiality, given that the alleged unlawfulness is limited to those who posted illicit content”. [pp. 23-24]

He found that if the bakery’s request were accepted, it would ultimately “authorize access to personal data without having provided, as required, the URL of the users and worse, without demonstrating a minimum basis for the commission of an offense.” [p. 24]

Accordingly, prioritizing users’ right to privacy and preventing indiscriminate breach of confidentiality, Justice Salomão upheld Facebook’s appeal, rejecting the obligation to provide data of all users who shared the video. He therefore limited the order to providing data from those responsible for the posts specified in the URLs presented by the bakery.

---