On May 6, Bruno Bioni presented an oral statement at the Brazilian Supreme Court concerning the ADI n. 6387 case. It discussed the constitutionality of MP 954, which demanded telecommunication companies to share consumers’ personal data (i.e., name, telephone number, and address) for the statistic research. Please find the full transcription in English below:
Oral Statement – ADI [1] 6.387
Amicus Curiae Data Research Association Data Privacy Brasil
I – Greeting
Good afternoon,
Honorable President Justice,
Honorable Reporting Justice,
Honorable Justice,
Honorable General Public Prosecutor of the Republic,
II – Presentation
First and foremost, I would like to state that it is a honor to use the word for the first time along this Court, and deserve the attention of your Honors. I apologize for not following strictly the liturgy and direct myself to Your Honors without a robe, but this is out of my control and is affecting all of us: the pandemic that impeded me of going out to buy a proper garment.
II – Object of the Demand
The same pandemic impedes the Brazilian Institute of Geography and Statistic (IBGE) to visit each citizen in order to conduct face-to-face interviews for the statistic research. This is the context behind the MP [2] 954 that imposes to telecommunication companies to share consumers personal data (i.e. name, telephone number and address). Considering the presentation of motives of the own MP, this should avoid a “statistic blackout”.
The 4 ADIs, beyond the ADI n. 6387, all of them strive for the material unconstitutionality of the MP under the argument of violation of the data protection right, of the right to privacy and of the confidentiality of communications. Therefore the question placed in today’s trial is: Does this provisional measure configures a disproportionate and excessive interference on a fundamental right?
III – Summary of the thesis
I speak in singular, a fundamental right because, representing the Research Association Data Privacy Brasil, my intervention is divided in two parts: a) the first part aims to identify exactly which of those rights in specific is being obstructed, since the claims vary on it; b) next, in the second part, I will desiccate why the MP configures an excessive interference towards the personal sphere of more than 230 million Brazilians.
III.A – Right to personal data protection: a conceptual and dogmatic trap
Regarding the first part, my argument is that the Federal Supreme Court has a historical opportunity to extract a new fundamental right: the right to personal data protection. In that sense, as made by the German Constitutional Court, in 1983, which, by coincidence, also analysed a measure regarding the use of data with statistical purposes (census) and considered that it could unfold a disproportionate interference.
This new right can be extracted from the constitutional text, but it is necessary to localise it topographically and dogmatically in an adequate way in the fundamental rights framework of the article 5th. Otherwise, we take a risk of falling into a conceptual trap whose result will be the precarization of the protection of the human person, instead of expanding according to the principle of the dignity of the human person and the caput of the article 5th.
A.1. Departing from the article 5th, XII
In the opposite sense of what supports the PGR [3], AGU [4] and even some of the parties in their petitions, what is at stake is not the protection conferred by article 5th, XII. Why? Because the Constitution does not protects only confidential data, but all and any type of data that is an attribute of the human personality.
Where could we extract the protection from?
At least, from three legal provision of article 5th, in a isolated or combined way:
A.2. Personal Data Protection as a constitutive element of the personality
The first one is the article 5th, X, that sets the inviolability of the intimacy, private life, honor and image. It is not coincidence that the constitutional assembly gathered all of those in one provision, all of them are assets of the personality. They are constitutive of who is a human person and of the way that this person is perceived by the society. Therefore, the protection is not directed to the aspects of human personality that must be locked under seven keys or that must be confidential. On the opposite, such legal remedy covers all extension of our individuality that must circulate for our free development as human beings.
The bipartition of the right to privacy in private life and intimacy is not a coincidence. Is the recognition that our personality reveals and develops itself from the circulation and not from isolation of information, and that it can be organized in cores more or less restricted – the famous sphere theory of privacy.
In the same sense, the right to image: no one is usurped from it by being in public square, neither because have monetized it to be the face of a marketing campaign.
Thus, the core of the protection granted by the item X, article 5th, and of what we are discussing today, has nothing to do, and I repete, nothing to do with the quality of a data as confidential. It deals purely and simply with the fact that it is personal, because it is an attribute of the human personality and, therefore, it is part of this private sphere lato sensu.
And, where else there is an opening in the constitutional text to recognize that a data deserves a protection for the simple fact of being a projection of us, for the simple fact that it is characterized as personal?
A.3. Habeas Data
The habeas data. The Constitution ensures a protection of a data being “relative to the person of the claimant”. Once again, the gravitational center of constitutional guarantees does not take into account if a data is confidential. As decided previously by this Court, in the Extraordinary appeal 673.707, Minas Gerais, reported by Justice Fux, is a right that embraces everything “with respect either directly or indirectly”. Therefore, is a right of the person to know how she/he is being seen, profiled in a database and, moreover, demand potentially a rectification. One more time, it does not have a relation to isolating information, but to guarantee an appropriate informational flow in order not to jeopardize the free development of the human personality. It has to do with in what measure a interference in the personal sphere could happen, and, ultimately, if it is proportionate, adequate.
A.3. Due process
This takes me to the third constitutional provision to ground a right of personal data protection as a fundamental right. Data protection is rooted in the due process clause. It is a type of protection that takes in consideration that the risk to public liberties is associated to the simple and mere data processing that is linked to a person.
There is no more insignificant data, because from the simplest and not from the confidential data it could extract informations of the highest value. With the technological advance experienced in the last decades, it is possible to form a frame quite complete of the personality without the control of precision and use by the person that owns this data, and this can turn against this person and suffocate his or her liberties. I am here paraphrasing a decision of the German Constitutional Court that recognized the unconstitutionality of the census bill in 1983, since there was no group of safeguards to avoid that the use of personal data for statistical purposes would circumvent the social control.
Unfortunately, we have two frightening episodes that illustrate it well.
The first one in the development of the Second World War.
Why it was so easy for the nazi to persecute jewish people in Amsterdam, as said in history books and, even, in the Diary of Anne Frank? Because there the municipal urban planning utilized personal data without the necessary precautions. I was collected unnecessary data that made possible to infer the religious belief of the people, even if there was no such specific annotation in the databases.
The second more recent and widely reported by the national and international media was the so called Cambridge Analytica case. As it is indicated the elections were manipulated because it became possible not only to know, by using a simple quiz in a certain social network platform, the personality of hundreds of people. However, most importantly because there was the possibility to know just the names of the thousands of friends of the people who answered the quiz.
For this reason that the German Constitutional Court decided, and is what today this Court could also do, that the major risks of liberties are associated to the mere use of personal data, if they are sensitive or confidential is less important.
Therefore, the bone structure of personal data protection right also derives from the due process, here expressed by the establishment of basic guarantees that are the limits and the possibilities regarding the use of our information.
First and foremost, a right that serves to the own State as a way to avoid being incapacitated to have access to this important public resource. By adopting the proper safeguards for data processing, governments avoid the fiction of collective trust.
This consducts me to the second, and last part of my intervention that is the analysis of the text of the MP 954/2020:
III.B – MP as a disproportionate interference
The recognition of the right to personal data protection is not against governments, is not against this or other initiatives with regards to the use personal data, but it is about how it should be done. It is about how an interference over the personal sphere may be legitime and avoid catastrophes. Its is about fairness, how it is proposed by the so called the fair information practice principles. And this can not be observed in the MP 954, which is disproportionate because:
B.1. Necessity-minimization
If the research is sampling and in the last years covered near 200 thousand residencies, there is no necessity of sharing the totality of the database of telecommunication companies that cover more than 230 millions of people. It would be necessary and proportionate to do only the forwarding of the portion of the database, which would, in geographic terms, constitute a representative sampling of the reality of Brazilian residences.
B.3. Other safeguards
The truth is that both the MP and the normative instruction knows that they interfere on a fundamental right and, it is necessary to recognize, that there was an effort to articulate safeguard measures. In this sense, it is not for any other reason that the text anticipates obligations from a law that is not yet fully effective which is the General Data Protection Law. However the effort was insufficient.
I could cite other nine elements regarding the disproportionality of the MP that are described in our written manifestation in the process file and it is detailed by our report Privacy and Pandemic, such as the detailing of the security measures to avoid data breaches, the indication of a data protection officer, among others.
B.4. The absence of a National Data Protection Authority
Even if it was considered that the MP and the normative instruction offer adequate safeguards, who would supervise the materialization of the precautionary measures? It lacks an institutional infrastructure for it since the Brazilian Data Protection Authority was not yet structured. Even though, LGPD was approved in 2018.
III – Conclusion
Beyond the declaration of the unconstitutionality of the MP, this case has all features to be historic. It has the potentiality to update the constitutional fundamental rights framework of the Constitution. To include a right that has nothing to do with the segregation, nothing to do with confinement, because, paraphrasing Hanna Arendt, bringing light over the prefix idion of individual, the one that lives in complete secrecy and, I would add the judicial protection that only stimulated the isolation, would be idiot. It is not about that.
It is about recognizing the risk to our human condition, to use the title of the notorious book from the german philosopher, it is associated to the use and abuses with regards to the signs of our identity, our personal data whose protection instrumentalize a series of other liberties. A right that is a enabler of our social sphere, of how we are and how we relate to ourselves. Ultimately, a right that is a pillar for our social contract and even more when we experience a society in which a bone and flesh person is judged more and more based on their personal data, in what a database says about this person.
Bruno Bioni – Founder-Director of the Research Association Data Privacy Brasil
______________________________________________
[1] ADI – Brazilian abbreviation for Direct Action of Unconstitutionality.
[2] MP – Brazilian abbreviation for Provisional Measure which are edited by the President of the Republic.
[3] PGR – Brazilian abbreviation for General Prosecutor of the Republic.
[4] AGU – Brazilian abbreviation for General Attorney of the Union.
Assuntos
Compartilhe