(Apr. 29, 2014) On April 24, 2014, Brazil published Law No. 12,965, which establishes principles, guarantees, rights, and obligations for the use of the Internet in the country. (Lei No. 12.965, de 23 de Abril de 2014, PLANALTO.)
The regulation of the use of the Internet in Brazil is based, inter alia, on respect for freedom of expression, human rights, personality development, and the exercise of citizenship in digital media; plurality and diversity; openness and collaboration; free enterprise, free competition, and consumer protection; and the social purpose of the Internet (id. art. 2).
The principles that regulate the use of the Internet in the country include:
• a guarantee of freedom of expression, communication, and thought under the terms of the Constitution;
• protection of privacy;
• protection of personal data, as provided by law;
• preservation and guarantee of Internet neutrality;
• preservation of the stability, security, and functionality of the Internet, through technical measures consistent with international standards and by encouraging the use of best practices;
• accountability of agents for their activities, as provided by law;
• preservation of the participatory nature of the Internet; and
• freedom of business models promoted on the Internet, provided they do not conflict with other principles established in Law No. 12,965 (id. art. 3).
The regulation aims to promote the right of all persons to have access to the Internet; access to information, knowledge, and participation in cultural life and the conduct of public affairs; innovation and the widespread dissemination of new technologies and usage and access models; and adherence to open technological standards that enable communication, accessibility, and interoperability between applications and databases (id. art. 4).
Rights and Guarantees
According to Law No. 12,965, Internet access is essential to the exercise of citizenship. For this purpose, the Law lists the rights of and guarantees for Internet users, which include:
• inviolability of intimacy and privacy;
• protection and compensation for property or moral damages resulting from such violation;
• inviolability and secrecy of the flow of a person’s communications through the Internet, except by court order, as provided by law;
• inviolability and secrecy of a person’s private communications that have been stored, except by court order (cf. id. art. 10);
• no suspension of Internet connection, except for debt directly resulting from its use;
• maintenance of the contracted quality of Internet connection;
• non-provision of a person’s personal data to third parties, including connection logs, and access to internet applications, except through free, express, and informed consent or in circumstances specified by law (with provision of records by means of a court order, cf. id. art. 10);
• express consent to the collection, use, storage, and processing of personal data, which must be done in a clear manner, distinct from other contractual clauses;
• definitive deletion of the personal data provided to certain Internet applications at the end of the relationship between the parties, except in cases of mandatory recordkeeping as provided for in Law No. 12,065; and
• application of the norms of consumer defense and protection in consumer relations conducted on the Internet (id. art. 7.)
The guarantee of the right to privacy and freedom of expression in communications is a prerequisite for the full exercise of the right of access to the Internet. Contract clauses that violate this provision are null and void, as well as clauses that violate the right to secrecy of private communications over the Internet and that, in adhesion contracts, do not offer an alternative to the contractor to adopt the Brazilian forum for resolution of disputes arising from services rendered in Brazil (id. art. 8).
Protection of Records, Personal Data, and Private Communications
Brazilian law and the rights to privacy, protection of personal data, and confidentiality of private communications and records must apply to any operation involving the collection, storage, treatment and custody of records, personal data, or personal communications by connecting providers and Internet applications wherein at least one of these acts occur in the national territory. This applies to data collected in the national territory and to the content of communications, provided that at least one of the terminals involved is located in Brazil. These provisions are applicable even if the activities are performed by a company domiciled abroad, provided that the company offers services to the Brazilian public or at least one member of the company’s economic group is established in Brazil (id. art. 11).
Notwithstanding other civil, criminal or administrative sanctions, violations of the rules established in articles 10 and 11 of Law No. 12,965 are subject to the sanctions determined by article 12, which include a warning, a fine, temporary suspension of activities, and/or prohibition of the exercise of activities in the country. In the case of a foreign company, its subsidiary, branch, office, or establishment in the Brazil is jointly and severally liable for the payment of the fine (id. art. 12).
Custody of Connection and Access Records
It is the responsibility of the administrator of a provider of an Internet connection to keep the connection and access records, under secrecy, in a controlled and secure environment; connection records must be kept for a year and access records for six months. The responsibility for maintaining the connection records cannot be transferred to third parties. The police or administrative authority or the Public Prosecutor’s Office may request the storage of connection records for longer periods. In any case, the ability to retrieve the connection and access records must be judicially authorized (id. arts. 13 & 15).
Responsibility for Damages Caused by a Third Party
A provider of Internet connections will not be liable for civil damages arising from content generated by third parties (id. art. 18). Such providers can only be liable for civil damages arising from content generated by third parties if, after the issuance of a specific court order, the provider does not make arrangements, within the scope and limits of its technical service and within the indicated time, for making the content identified as being in violation of the law unavailable, subject to the legal exceptions (id. art. 19).
Law No. 12,965 enters into force 60 days after its publication (id. art. 32).