Case Summary and Outcome

The Supreme Court of Brazil stayed the implementation of a provisional measure which mandated telephone carriers to share all data of their subscribers with the Brazilian statistics agency. After the scheduled census moved from in-person to telephonic interviews as a result of the Covid-19 pandemic, the Brazilian President enacted the measure, on the request of the statistics agency. The Brazilian Bar Association challenged this measure, arguing that it violated the constitutional protections of the right to privacy, the confidentiality of communications, and respect for private life. The Court held that there was a lack of protective measures and transparency in the measure and that its scope was too broad to justify the significant limitations to the rights to privacy and data protection.

Facts

In 2020, the Brazilian national census was interrupted by the Covid-19 pandemic and in-person surveys were suspended. The Brazilian statistics agency – Instituto Brasileiro de Geografia e Estatística (IBGE) – decided to switch to telephone interviews to report on statistics during the pandemic, and submitted a request to the economy minister for a provisional order mandating telephone carriers to provide the IBGE with subscriber data to enable these interviews. The request was sent to President Jair Bolsonaro who accordingly enacted Provisional Measure no. 954/2020. Under the Brazilian Constitution, provisional measures are a type of legislation, adopted by the president which go into force immediately and are later reviewed by Congress.

The provisional measure mandated carriers to share data – including names, phone numbers and addresses – on all their subscribers within seven days of a request from the IBGE. It also stipulated that the data should be used exclusively by the IBGE for official statistics, with the aim of conducting non-face-to-face interviews in the context of household surveys during the pandemic, and that the data was to be kept confidential and be deleted from the agency databases after pandemic restrictions were lifted. Under the provisional measures, the IBGE was also required to publish a data protection impact assessment (DPIA), as provided by the General Data Protection Law (Law no. 13.709/2018). Although this General Data Protection Law was already approved at the time of the decision, it was not yet in force.

On April 20, 2020, the federal council of the Brazilian national bar association, Ordem dos Advogados do Brasil (OAB), challenged the provisional measure, arguing that it violated the constitutional protections of the right to privacy, the confidentiality of communications, and respect for private life. The OAB also believed that the procedural requirements for the enactment of the provisional measure had not been met as the Constitution reserves these measures for “relevant and urgent cases”. Article 5 of the Constitution states: “Everyone is equal before the law, with no distinction whatsoever, guaranteeing to Brazilians and foreigners residing in the country the inviolability of the rights to life, liberty, equality, security and property on the following terms: … x) personal intimacy, private life, honour and reputation are inviolable, guaranteeing the right to compensation for pecuniary or moral damages resulting from the violation thereof … xii) secrecy of correspondence and of telegraphic data and telephonic communications is inviolable, except, in the latter case, by court order, in the situations and manner prescribed by law for purposes of criminal investigation or the fact-finding phase of a criminal prosecution”.

The OAB argued that subscriber data, even when limited to name, telephone number and address, exposed individuals to serious harm, as data was liable to misuse of all kinds, including in disinformation campaigns and as part of voter manipulation strategies. The OAB submitted that the provisional measure violated the right to privacy and the related personality rights, based on the broad principle of legitimate public interest, proportionality and necessity. In addition to arguing that the provisional measure infringed the right to privacy and to confidentiality of communications, the OAB argued that the Court should adopt the approach used by the German Court in the federal census case BVerfGE 65, 1 (1983), which included a new heading of “informational self-determination” under the right to respect for private life. The OAB submitted that the provisional measure failed to provide secure measures for the handling of the data, and that the stated purpose of the measure was too generic. It added that the provisional measure failed to pass the proportionality test.

The government maintained that the criteria for the enactment of the provisional measure under article 62 were met, arguing that the impacts of the pandemic and the need for statistical information to guide its policy for relief made it a “relevant and urgent case”. With reference to the case of Brazilian Labour Party v. President of the Republic of Brazil ADIN No. 2859, (February 24, 2016), the government argued that the confidentiality of subscriber data was not breached by sharing it with the statistics agency and that the IBGE would be required to respect the confidentiality of that data. It submitted that even though only a subset of subscribers would be contacted by the IBGE the sharing of all data was required because of the need to make sure the sample was statistically valid for the survey.

The Prosecutor-General added that the data was not protected under the provision on the confidentiality of communications and data, relying on Luciano Hang v. Federal Prosecution Service Recurso Extraordinário No. 418416 (May 10, 2006), which had held that only the communication of data – and not stored data – fell under that provision. He also argued that the respect for private life was not violated, as the data was not of an intimate nature but rather “basic identification required for all human interaction in society”.

On April 24, 2020, the Supreme Court granted an emergency stay of the provisional measure before the application for an injunction was to be heard on the merits before a full court.

Decision Overview

Judge Rosa Webber served as the rapporteur of the Supreme Court, and was joined in this judgment by Judge Celso de Mello, and nine other judges endorsed the rapporteur’s judgment. (Note: In Brazilian courts, the opinion of the rapporteur is not the opinion of the Court per se, but the case is generally cited with reference to the opinion of the rapporteur, who also prepares the headnotes for the decision). The central issue for the Court’s determination was whether the provisional measure was unconstitutional because it violated constitutional rights.

In a constitutional complaint, the Court must establish whether the act in question violates the Constitution directly, as opposed to whether it is inconsistent with other legislation. An application for an injunction in a constitutional complaint requires that the complainant demonstrate the probability of success on the merits as well as the urgent need for staying the implementation of the act in question.

Judge Weber held that the provisional measure did not specify the scope, purpose and reach of statistics for which the data would be used. She added it was not clear from the language of the provisional measure why the collection of the data was strictly necessary for the IGBE. Judge Weber emphasized that only 200,000 individuals were said to be included in the survey, which she viewed as evidence that the sharing of data on roughly 200,000 million subscribers was excessive, and that the purpose of the provisional measure could be achieved through the sharing of far fewer subscribers’ data.

Judge Weber also held that the provisional measure did not include technical and organizational measures designed to prevent unauthorized access to the data, security incidents or abuse.

The other judges who endorsed Weber’s judgment entered opinions with similar reasoning, with many emphasizing the importance of data protection and some going as far as positing a constitutional right to data protection. Judge Luiz Fux held that the provisional measure “lacked the transparency and information required for a proper comparison and reconciliation between the need for statistical production and the fundamental rights to data protection and informational self-determination” [p. 73]. Similarly, Judge Gilmar Mendes stated that “the protection of a fundamental right to data protection is no longer constrained to the demarcation of a private space, but, rather, it asserts itself in the right to governance and transparency in the treatment of data acknowledged in a broad sense” [p.109].

Conversely, Judge Marco Aurélio seemed to agree with the government’s submission that the statistics were essential. He also seemed to agree with the prosecutor-general that the data was too limited to pose any serious risk, or to infringe on the protection of private life, and noted that as the provisional measure would still be reviewed by Congress it would not be proper for the Court to decide before Congress had assessed it.

Accordingly, the Court confirmed the stay granted by the rapporteur, enjoining the provisional measure from entering into effect. The case then became moot when the period for review of the provisional measure by Congress elapsed without a vote.