Q&A: How Civil Society in Brazil Is Defending Privacy Rights
The Brazilian Supreme Court recently blocked the implementation of a surveillance program intended to use cell phone data to help the government coordinate its COVID-19 response. The ruling recognized the possible harms associated with a government-led surveillance program that does not have adequate safeguards. The Open Society Foundations’ Hannah Draper spoke with Bruno Bioni, the founder of Data Privacy Brazil, about the ruling.
How has the Brazilian government sought to use data gathered from cell phones in their efforts to fight against COVID-19?
Both the federal government and at least 14 of 27 state governments have sought to capture Brazilians’ data to inform their COVID-19 response. Many of the states have partnered with a third party that will collect this information. The state of São Paulo has entered into agreements directly with a third-party company, as well as four telecommunications companies that operate in Brazil themselves. And the federal government recently tried to institute a program that would allow it to collect, manipulate, and store information on 200 million Brazilians.
Why is that worrisome?
We at Data Privacy Brazil have been watching these initiatives carefully, and we recently detailed our concerns in a report entitled Privacy & Pandemic [Portuguese PDF].
Chief among those concerns is a lack of transparency. It’s not clear, for example, what anonymization tools the government plans to use to protect people’s identities. This is a key piece of any digital surveillance tool. Right now, we don’t know if the government will protect our information to ensure it is not leaked to, or stolen by, third parties. And the government has provided no information about how, or if, it will be discarded.
What are some of the risks that come with such a lack of transparency?
It’s important to emphasize that our fears here are not simply in the abstract or theoretical realm. Quite the opposite. For example, the pandemic has exposed how people can become vulnerable if their health status is leaked.
Indeed, there are already many examples from around the world of people being shamed, harassed, or even targeted with death threats after they were identified, through digital means, as COVID-19-positive. So, this is just one reason why we are wrestling with these issues and trying to find a way to ensure that any government surveillance tools do not expose Brazilians to additional harm.
What influence will these cases have on the Brazilian government’s approach?
As pointed out by Justice Luis Roberto Barroso, this ruling does not prevent the government from using data in its efforts to fight COVID-19. At the same time, though, the ruling makes it clear that any government effort to use data must also include proper safeguards. So, the government must revise its approach to be in line with the court order and to ensure that sensitive information about Brazilians is protected.
Does the Brazilian data protection law, which is scheduled to go into effect in 2021, empower Brazilians to protect their rights in this regard?
Yes and no. The law is still in its grace period and therefore it is not enforceable. Nevertheless, there are several laws and norms—including the Constitution of Brazil—which reinforce basic principles ensuring Brazilians privacy and rights.
What have the courts said about the government’s programs?
Brazil’s Supreme Federal Court recently halted a presidential executive order that mandated telecom companies share the subscriber data of more than 200 million people. Arguably, the reasoning of the decision was just as important as the actual ruling, because the court ruling seems to signal a willingness to recognize the protection of personal data as a fundamental right—separate from the right to privacy.
Do you believe this case may have an impact on the way other governments outside of Brazil approach these issues?
Absolutely. We believe that the eyes of the world are on us. Judges reviewing data and privacy cases in other countries will likely look at this ruling, prior to making their own judgements. And what they’ll see is that, even in the middle of a public health and political crisis, Brazilian society managed to stop a policy that really threatened the fundamental rights of more than 200 million citizens.
Beyond the courts themselves, we are hopeful that like-minded civil society groups will be inspired to challenge their government’s surveillance policies if they too do not respect these fundamental data rights.
Data Privacy Brazil is a grantee of the Open Society Foundations.
