The Americas: Argentina | Brazil | Mexico
East Asia, South Asia and Pacific: Australia | China | India | Japan | South Korea | Taiwan
Europe and Central Asia: European Union | England | France | Iceland | Italy | Norway | Portugal | Russia | Spain | Turkey
Middle East and Africa: Iran | Israel | South Africa | United Arab Emirates
As of February 2020, Brazil had over 227 million active cell phones and a population of 210 million people. A new law, which will enter into force in August 2020, has been enacted for the purpose of protecting personal data.
In an effort to help track the spread of COVID-19, the government enacted a Provisional Measure for data sharing by telecommunications companies to support the generation of official statistics. However, the Brazilian Federal Supreme Court later issued an injunction suspending the Provisional Measure as a preliminary response to several Direct Unconstitutionality Actions that were filed by different entities.
The federal government has also issued a law specifying measures that may be adopted by the authorities within the scope of their competences to address the public health emergency resulting from the COVID-19 outbreak.
On May 22, 2020, Brazil’s Ministry of Health registered 310,987 confirmed cases of COVID-19 and 20,047 deaths in the country. According to the National Agency of Telecommunications (Agência Nacional de Telecomunicações, ANATEL), in February 2020 Brazilians had 227.1 million active cell phones.
II. Legal Framework
A. Privacy and Data Protection
On August 14, 2018, Brazil enacted Law No. 13,709, the General Data Protection Law (Lei Geral de Proteção de Dados), which provides for the processing of personal data, including digital media, by either a natural person or a public or private legal entity in a manner that protects a person’s fundamental rights of freedom, privacy, and free development of personality. The new law will enter into force in August 2020.
The law regulates the protection of personal data and applies to any processing operation carried out by a natural person or a legal entity under public or private law, regardless of the medium, the country of the entity’s headquarters, or the country where the data is located. The law also sets forth exceptions to its application and the principles that need to be observed when processing personal data.
The law defines how the processing of personal data is to be carried out, including, but not limited to, with the consent of the person; in compliance with the controller’s legal and regulatory obligations; and for the protection of health in a procedure exclusively performed by health professionals, health services, or the health authority. It also establishes how the processing of sensitive personal data is to occur.
B. Data Retention and Location Tracking
1. Provisional Measure No. 954 of April 20, 2020
On April 17, 2020, Brazilian President Jair Bolsonaro enacted Provisional Measure No. 954, which provides for data sharing between telecommunications companies that offer Fixed Switched Telephone Services (Serviço Telefônico Fixo Comutado, STFC) and Personal Mobile Services (Serviço Móvel Pessoal, SMP) and the Brazilian Institute of Geography and Statistics Foundation (Fundação Instituto Brasileiro de Geografia e Estatística, IBGE), for the purpose of supporting the generation of official statistics during the COVID-19 public health emergency, which Law No. 13,979, of February 6, 2020, deals with.
Telecommunication companies providing STFC and SMP must make available to the IBGE, in electronic form, a list of names, telephone numbers, and addresses of their consumers, whether individual persons or companies. The data will be used directly and exclusively by the IBGE for generating official statistics, with the objective of conducting household surveys in a non-face-to-face manner.
The shared data will be confidential; will be used exclusively for generating official statistics; will not be used as a certificate or evidence in administrative, fiscal, or judicial proceedings, under the terms of Law No. 5,534, which establishes the obligation to provide statistical information.
The IBGE is prohibited from making the data available to any public or private companies or bodies, or to entities of the public administration of any of the federative entities. The IBGE will provide information on its website concerning the situations in which the data have been used and will release an impact report on the protection of personal data, under the terms of Law No. 13,709. Once the public health emergency resulting from COVID-19 has been overcome, pursuant to the provisions of Law No. 13,979 of 2020, the information shared must be deleted from the databases of the IBGE.
2. Database and Tracking Systems
On April 12, 2020, a Brazilian newspaper reported that a group of telephone companies were planning to make a large database available to the Ministry of Science, Technology, Innovations and Communications based on information from their transmission towers, which could identify the movement of people. A similar project has also been implemented in the State of São Paulo. In addition to large corporations like Google and Facebook who are also developing similar tracking projects, the Brazilian startup InLoco has created a map of social isolation in the country divided by states, the newspaper reported.
According to the website of the startup, the social isolation index was developed to combat the COVID-19 pandemic. The map shows the percentage of the population that is respecting the isolation recommendation. The purpose of the map is to assist authorities in directing the application of public security, communication, and health resources to the appropriate areas.
Furthermore, the newspaper stated that the telephone companies will use the data in an aggregate manner, which means that governments would not have access to individualized information, but only compiled data to indicate major trends. At the end of the pandemic emergency the database will cease to be used, but during the emergency the information will be stored on a publicly owned server. The government will decide what will be done with the data and with what institutions to share it with.
III. Electronic Measures to Fight COVID-19 Spread
A. Dedicated Coronavirus App to Stop Spread of the Virus
On March 2, 2020, the Ministry of Health launched the Coronavirus–SUS app for the purpose of making the population aware of COVID-19. The app provides information on various topics such as symptoms, how to prevent infection, what to do in the case of suspected or actual infection, and other relevant information. It also provides a map indicating the location of nearby health units.
B. Compatibility of Measures with Privacy Rights/Data Protection Principles
1. Federal Supreme Court Injunction
On April 24, 2020, Justice Rosa Weber of the Federal Supreme Court (Supremo Tribunal Federal, STF) granted an injunction (medida cautelar) suspending Provisional Measure No. 954, as requested in five Direct Unconstitutionality Actions (Ação Direta de Inconstitucionalidade, ADI) proposed by the Federal Council of the Brazilian Bar Association (ADI 6387) and four different political parties (ADIs 6388, 6389, 6390, and 6393). In the preliminary analysis of the actions, Justice Weber pointed out that
the information under [Provisional Measure No.] 954 is within the scope of constitutional protection (article 5 of the Constitution), which supports the right to personal intimacy, private life, honor and reputation of people. . . . [T]he MP does not foresee any requirement of mechanisms and procedures to ensure the confidentiality and anonymity of the shared data, which does not meet the requirements established in the Constitution for the effective protection of fundamental rights of Brazilians.
Justice Weber also highlighted that there is no legitimate public interest in sharing the personal data of users of telephone services and that the standard does not provide conditions for assessing their suitability and need, as it does not define the form or purpose of the use of the data collected, in apparent violation of the law. She further added that the seriousness and urgency resulting from the current health crisis cannot be underestimated, nor the need to formulate public policies that demand specific data to face the COVID-19 outbreak. However, she stated that the fight against the pandemic cannot legitimize “the trampling of fundamental guarantees enshrined in the Constitution.”
Under these arguments, Justice Weber granted the injunction “in order to prevent irreparable damage to the intimacy and confidentiality of the privacy of more than one hundred million users of fixed and mobile telephone services,” and determined that the IBGE must refrain from requesting the data provided for in Provisional Measure No. 954. If the information has already been requested, the request must be suspended, with immediate communication to the telephone companies, she said.
Justice Weber’s decision will be submitted to the plenary of the STF for analysis and confirmation.
2. Use of Geolocation Halted
Under the justification that privacy risks need to be better evaluated, President Jair Bolsonaro determined that the Ministry of Science, Technology, Innovations and Communications should halt negotiations with telephone companies concerning the use by the federal government of aggregated and anonymous geolocation information from several citizens. The information had been sought as a means to monitor what percentage of people in a given region are following the government’s guidance to stay at home as much as possible.
C. Consequences for People Who Have Been in Close Contact with Infected Persons
Law No. 13,979 provides that the authorities may adopt, within the scope of their competences, the following measures to address the COVID-19 outbreak:
I - isolation;
II - quarantine;
III - determination of compulsory:
a) medical examinations;
b) laboratory tests;
c) collection of clinical samples;
d) vaccination and other prophylactic measures; or
e) specific medical treatments.
For the purposes of Law No. 13, 979, “isolation” is defined as the separation from others of sick or contaminated persons, or of luggage, means of transportation, goods, or affected postal parcels, in order to avoid contamination or the spread of the coronavirus. “Quarantine” is defined as the restriction of activities or separation of persons suspected of contamination from persons who are not sick, or the separation of luggage, containers, animals, means of transportation, or goods suspected of being contaminated, in order to avoid possible contamination or the spread of the coronavirus.
People must comply with these measures and a failure to comply will result in liability, as provided by law.
Prepared by Eduardo Soares
Senior Foreign Law Specialist
 Agência Nacional de Telecomunicações, https://www.anatel.gov.br/paineis/acessos/telefonia-movel.For comparison purposes, on July 1, 2019, the Brazilian population was estimated to be approximately 210.15 million persons. Estimativa da população do Brasil Passa de 210 Milhões, Agência Brasil (Aug. 28, 2019), https://perma.cc/QJ4G-7TWD.
 Id. art. 65(II).
 Id. art. 2.
 Id. art. 3.
 Id. art. 4.
 Id. art. 6.
 Id. art. 7(I), (II), (VIII).
 Id. art. 11.
 Article 62 of the Brazilian Constitution determines that in relevant and urgent cases, the President of the Republic may adopt provisional measures that have the force of law. Such measures must be submitted immediately to the National Congress. Constituição Federal, art. 62, https://perma.cc/B596-Q5UP.
 Lei No. 13.979, de 6 de Fevereiro de 2020, https://perma.cc/PW22-WBL9. Law No. 13,979 provides for the measures that may be adopted to face the public health emergency of international importance resulting from the COVID-19 outbreak.
 MP No. 954, art. 2.
 Id. art. 2(§ 1).
 Id. art. 3.
 Id. art. 3(§ 1).
 Id. art. 3(§ 2).
 Id. art. 4.
 Id. (translation by author).
 Id. art. 2.
 Id. art. 3(§ 4).
Last Updated: 03/24/2021