Data retention provisions in the Marco Civil

22 Nov 2013

“Hard cases, it has frequently been observed, are apt to introduce bad law.”

Brazil is on the brink of passing its ‘Marco Civil’ – ­an exciting, ground-breaking piece of legislation, with crucial protections for human rights and democracy online. One provision of the law requires internet companies to respect Brazilian laws on privacy and data protection and gives the government the power to impose requirements that data is stored and managed in the country.

What are the implications of this if it sets a precedent for elsewhere? Are there potential dangers if such a provision is not exercised with care?

From a human rights point of view such provisions could raise human rights concerns if applied more widely than Brazil, if ­for example – companies are forced to move data from countries which protect personal data to those with no safeguards. In repressive countries it would open up new potential for those governments to access their citizen’s communication and make people more vulnerable.

The internet has strengthened and democratised freedom of expression and its global nature has allowed increasing free flow of information across borders. The ability to communicate instantly and globally is one of the major benefits the internet brings to democrats and those promoting human rights. Imposing technical requirements to keep data locally, in different jurisdictions with different laws, would place significant stress on the ability of the internet to operate in this way.

For companies providing internet services, the requirement raises technical and logistical problems. If those companies have to store data within specific countries, then storage will be based on political, not engineering decisions and this may not be the most effective way of servicing users. International companies would need to rebuild data storage to reflect national boundaries and while global internet companies may have the resources to do this, local companies or start-ups that want to offer their services in countries like Brazil may well not have the money or engineering capacity to organise data in this way. Local companies in the developing countries could be hit the hardest.

Finally, from the users point of view, this technical requirement is likely to increase costs and could have a severe impact on access to the internet and therefore on users as the cost of compliance might decrease affordability and potentially result in delays in the release of new products in countries with local storage requirements.

The passing of the Marco Civil would undoubtedly be a real advance for internet freedom overall, reflecting, as it does, the outcome of a broad consultative process as well as providing important protections for human rights. But this data clause carries with it dangers. The protection of peoples’ data from unwarranted surveillance is a global problem that needs a coordinated international solution, based upon respect for human rights. We need to be careful that solutions we create to solve one problem do not create problems elsewhere.