Brazil: Bill on fake news "goes over the top in some aspects"
The Federal Senate ('the Senate') passed, on 30 June 2020, the Bill 2630/2020 for the Law on Freedom, Responsibility and Digital Transparency on the Internet ('the Bill') which was introduced to the Senate on 24 June 2020, following the initial introduction of the Bill in May 2020.
In particular, the Bill, seeking to discourage the abuse or manipulation of information with the potential to cause individual or collective harm, establishes rules, and mechanisms for the transparency of network services and private messaging services over the internet. Furthermore, it intends to regulate providers of social networks and interpersonal communication services as well as strengthen the democratic process and promote access to the diversity of information on the internet in Brazil, and the use of information mechanisms and tools regarding boosted content and advertising presented to the user. Following the introduction to the Senate, the Senate amended the language of the Bill, but some provisions remain unchanged including the requirements for social networking providers to require and confirm identification, for phone carriers suspending accounts of terminated numbers on messaging apps, and for providers to be headquartered in or have legal representatives in Brazil capable of accessing the provider database remotely from Brazil.
What aspects of social media and communications does the Bill seek to regulate?
In order to improve security and transparency on the internet, the Bill outlines that the registration of accounts on social networks and interpersonal communication services must only take place when users have a valid identity document provided, a cell phone number registered in Brazil, and a passport for foreign cell phone numbers, further requiring providers of social networks and interpersonal communications to validate the identification provided. In addition, one of the aims of the Bill is to discourage the use of inauthentic accounts to disseminate misinformation in internet applications.
In this regard, Felipe Palhares, Partner at Palhares Advogados, told OneTrust DataGuidance, The Bill seeks to pierce the veil of anonymity in the use of social media and communications apps in order to make it easier to identify who posted a specific content, bringing more transparency to such services especially in connection with content that was promoted through the promotions paid services offered by social media companies. In trying to do so it goes over the top in some aspects, such as tracing the origin of a message sent over a communications application which could result in violations to privacy and data protection rights. One of the most controversial provisions of the Bill sets forth that communications apps have to keep a record of identical messages that were sent by more than 5 users within a period of 15 days and these records must contain the identification of the users that sent such messages, the date and time they were sent and the total amount of users that received them, What this provision does is to create a requirement of recording the chain of the forwarded message, allowing an individual to be traced in case the truthfulness of that message is later questioned. There are several privacy risks related to such provision as it would involve recording metadata on a huge number of people and if it is properly implemented it could result in creating ways to bypass the end-to-end encryption of communications applications as this would be the only way to confirm that the same message was sent to more than 5 users."
How does the Bill reconcile with the provisions of the LGPD?
In respect of reconciling with the LGPD's provisions, Palhares outlined that, "Although the Bill states that it abides by the ideals set forth in the LGPD it actually goes against major principles such as purpose limitation and data minimisation. Earlier drafts of the Bill imposed mandatory requirements on social networks and instant messaging apps to collect IDs and mobile phone numbers from all its users prior to allowing them to create an account or using the services. What that would accomplish is to enact a state of surveillance in Brazil, clearly disproportionate to the goal of fighting fake news, making it nearly impossible to reconcile with the LGPD."
How does the Bill affect Brazil's adequacy status?
Brazil has not been the subject on an adequacy decision from the EU, however the country hoped that with the enactment of the LGPD, its data protection rules would align the country closer with the GDPR. In this regard, Palhares highlighted that, "The Bill does not help Brazil's adequacy at all. As a matter of fact, it could have the opposite effect. As the Bill has potential to violate several privacy rights and as it goes against some of the provisions set forth by the LGPD, if it is enacted as a law it could diminish Brazil's chances of being recognized as an adequate jurisdiction by the European Commission."
Palhares noted on the current version of the Bill, "The language of the bill as passed by the Senate is simply bad and it is the result of the lack of public debate. If the Senate had carried public consultations, it would understand that a requirement to massively record metadata can indeed violate the privacy of the users. Recording the identification, date and time of every user that has sent a message identical to one that was sent by another 4 users is creating a system of surveillance that treats everyone as a potential suspect and it has the potential to suppress social movements. Sharing a hashtag such as #blacklivesmatter is not a crime but it would make the user that shared it a target of surveillance. Congress needs to understand that metadata could be as damaging as the actual content of the message. There is still hope that the House is able to enhance the bill passed by the Senate, correcting these wrongs."
Palhares concluded, "Instead of going after the root of the problem and strengthening law enforcement capabilities to investigate the criminal enterprises responsible for disseminating fake news, the Bill puts burdens both on users and on social media and communication applications, many of those in direct violation to the fundamental right of privacy and data protection. While other laws that had a huge impact on fundamental rights and the use of the internet such as the Civil Framework for the Internet and the LGPD were discussed during years with a strong participation from companies, civil society, associations and academia, this Bill lacks all of that. It lacks time to be better debated and enhanced, and to allow public participation. Congress is trying to pass a Bill quickly to protect itself in the upcoming elections. However, passing a bad Bill could be even worse than not having a Bill at all."
This article was amended on 1 July to reflect the passage of the bill on 30 June in the Senate.
Pranav Ananth Privacy Analyst
Comments provided by:
Felipe Palhares Partner
Palhares Advogados, São Paulo