On February 23, 2023, the Brazilian Supreme Court (STF) judged the “Ação Declaratória de Constitucionalidade (ADC) nº 51”, acknowledging the constitutionality of several legal provisions regarding international cooperation, as well as provisions of the “Marco Civil da Internet” and the Budapest Convention. Following the decision, the Brazilian authorities are authorized to request data and electronic communications to foreign internet providers with offices or legal representation in Brazil, regardless of the requirement to comply with international cooperation agreements, such as the Mutual Legal Assistance Treaty (MLAT), often used in criminal investigations in Brazil concerning individuals and assets in the United States.
The ruling upheld the understanding that had been adopted by the Brazilian Superior Court of Justice (STJ) with respect to Article 11 of the “Marco Civil da Internet” and Article 18 of the Budapest Convention. The Articles allow Brazilian authorities to request information directly if the data collection or processing is carried out in Brazil, the possession or control of the data is held by companies with legal representation in Brazil, and in cases of crimes committed by individuals in the Brazilian territory.
The award was also forwarded to the Legislative and Executive branches in order to enable them to introduce legislative improvements, such as the draft of the General Data Protection Regulation for Criminal Purposes and multilateral agreements to obtain data and electronic communications, such as the U.S. Cloud Act.
In the lawsuit, the “Federação das Associações das Empresas de Tecnologia” pursued the constitutionality of provisions for international legal cooperation, challenging the possibility of direct requests under Article 11 of the Marco Civil da Internet and Article 18 of the Budapest Convention. The reasoning was grounded on the assumption that Brazilian jurisdiction over the Internet should be governed by the territoriality principle, which imply the enforcement of the Brazilian Decree No. 3.810/2001, the Article 237, II, of the Code of Civil Procedure, and the Articles 780 and 783 of the Code of Criminal Procedure. These articles constitute a framework for international legal cooperation in order to obtain evidence located abroad (expedition of letters rogatory, unilateral or multilateral agreements, and others).
On the other hand, the Brazilian Judiciary also showed some difficulties related to the data stored or transferred abroad, as well as to the fact that the data is commonly protected and any interception carried out is ineffective due to the sophisticated cryptography. The understanding of the Brazilian Supreme Court, therefore, established to what extent the Judiciary may request companies, such as social networks or email and messaging providers, to grant Brazilian authorities access to private communications and data stored abroad, outlining relevant issues related to the fundamental rights of privacy and data security.
Foreign companies largely argue that data may only be disclosed to other States under international collaboration agreements for evidence sharing. The concern of these companies with the direct requests is that they could be exposed to the legal regime of the country that issued the judicial order in the absence of any international cooperation protocol, thus paving the way for possible abuses and bringing with it the risk of exposing them to violations of the data protection regulations of the country where they are headquartered, which could jeopardize their business models.
To address the issues above, the Brazilian Supreme Court ruled that restricting Brazilian jurisdiction over the Internet would undermine the effectiveness of ongoing investigations in Brazil, with consequences for the prosecution of cybercrimes and with further implications for public safety and for the protection of fundamental rights. On the grounds of Article 18 of the Budapest Convention (Brazilian Legislative Decree No. 37/2021) and Article 11 of the Marco Civil da Internet, the Brazilian Supreme Court has defined the criteria for extending Brazilian jurisdiction, such as in the event that the collection and processing of data occurs in Brazil, the possession or control of the data is carried out by companies with representation in Brazil, and in the case of crimes committed by individuals in the Brazilian territory. These cases emphasize the phenomenon of “territorialization” of cyberspace, widely discussed in international law.
In brief, the Brazilian Supreme Court held that the direct request rules contained in the Marco Civil da Internet and the Budapest Convention are specific when compared to the other rules and standards of international legal cooperation, as long as at least one of the events cited above has taken place in the Brazilian territory and the legal entity holding the data is located or stores the data in a foreign country. Through the recognition of the specific rule, the direct request of data, records and electronic communications related to actions taken within Brazil is now authorized for Brazilian authorities. For cases that are not covered by Article 11 of the Marco Civil da Internet and Article 18 of the Budapest Convention, the appropriate legal instrument is still the international legal cooperation and the traditional procedural measures, such as letters rogatory.
The Civil and Intellectual Property teams of Salusse, Marangoni, Parente e Jabur Advogados would be pleased to assist you and answer any questions you may have by the following emails: w.jabur@smabr.com, e.guedes@smabr.com, l.dias@smabr.com, v.ueda@smabr.com.
