Brazilian Congress to vote on mandatory storage of personal data in Internet

The Bill known as “Internet Civil Rights Framework” (Marco Civil da Internet in Portuguese)   seems ready to be voted in the Parliament’s lower house this week. Besides a handful  of polemic measures regarding issues as net neutrality, the Bill proposes a very strict obligation to Internet sites: they must keep a log of their access and usage for the last six months.

This piece of legislation would make mandatory the retention of personal data – not only for the connection provider (which would be constricted to keep records of the whole last year of connections according to art. 14 of the Bill), but this time for the so-called ‘application provider’.

This measure is present in article 16 of the last version of the Bill:

Art. 16. The legal entity who acts as a provider of Internet applications and who exercises its activity in an organized, professional and pursuing profit, shall keep the records of  access to its Internet applications, in secret and in a secure and controlled environment, for a period of six months, according to the terms to be set forth by further regulation.

This measure not only contradicts all previous versions of the Bill (which is a work in progress started by a draft generated by a public consultation in 2010). It establishes an unprecedented  duty to all “for profit” Brazilian Internet players who run a site or service to keep private information of their users for 6 months, regardless of any consideration about their users’ consent.

Even if the Bill mention protection measures for the data owners, it is clear that the simple fact of the existence of the mandatory personal data register is, ‘per se’, a danger that users cannot avoid since their free consent would be not taken into account. Moreover, the lack of a general framework for personal data protection makes the whole environment at least very prone to the misuse of personal information.

Several Brazilian NGO’s and Civil Society organisations stressed this week their concerns regarding this issue.

[UPDATE 24 february] The voting was postponed to next week (around February 25)

[UPDATE 17 march] Congress is yet to vote the Bill. Last week, PMDB (a political party that is part of the governing coalition but has his own views on the Marco Civil Bill) presented an alternative version for Marco Civil [available here]. Its main points are: (i) Net Neutrality isn’t mandatory; (ii) data centres of Internet companies  won’t  have to be located in Brazil; (iii) Brazilian Telecommunicarion’s Agency (ANATEL) would draft the exceptions to net neutrality.