data holders and to the national authority. The Law determinates that the notification
shall be made in reasonable time and must state details about the incident, for
instance the nature of the affected data, risks related to the breach, security measures
adopted to protect the data, among others (Article 48).
Legislation provides a relevant role to supervision authorities in cases of security
fail. The supervisory board is supposed to verify the severity of the incident, assure
data holder rights and determinate measures to allay damages (Article 48, §2nd).
3.5 Data Protection in Electronic Communications Sector
In Brazil, there is no specific legislation regarding the electronic communication
sector. Thus, this sector must attend the general rules provided in the Brazilian Civil
Rights Framework for the Internet (Federal Law n
12.965/2014) and in the Brazilian Personal Data Protection Law (Federal Law n
13.709/2018). Consequently, all
the provisions about confidentiality, security measures and obligations in case of a
breach of security are also applied to electronic communications.
3.6 Data Protection and Digital Forensics
When it comes to digital forensics, the Brazilian Law provides specific legislation
about two main topics: (a) crimes through electronic means and (b) interception of
communication data for the purpose of investigation, detection and prosecution of
crimes.
Concerning crimes through electronic means, the Brazilian Cybercrimes Law
(Federal Law n
12.737/2012) is worth mentioning. This Act typifies crimes such as
computing device invasion providing penalties of up to 2 years of detention.
Regarding the interception of communication data for the purpose of the investigation, detection and prosecution of crimes, the relevant legislation is the Federal
Law n
9.296/1996. According to this law, interceptions may be determined “by a
judge, ex officio or upon request of: I- the police; and II- the prosecutor” (Article 3).
The Law, however, forbids interceptions when: (1) there is no reasonable indications
of authorship or participation in a criminal offence; (2) it is possible to produce
probative evidence by other means; and (3) the fact investigated constitutes criminal
offence punishable, at most, with a custodial sentence (Article 2).
Right to Privacy and Personal Data Protection in Brazilian Law
51
shall be made in reasonable time and must state details about the incident, for
instance the nature of the affected data, risks related to the breach, security measures
adopted to protect the data, among others (Article 48).
Legislation provides a relevant role to supervision authorities in cases of security
fail. The supervisory board is supposed to verify the severity of the incident, assure
data holder rights and determinate measures to allay damages (Article 48, §2nd).
3.5 Data Protection in Electronic Communications Sector
In Brazil, there is no specific legislation regarding the electronic communication
sector. Thus, this sector must attend the general rules provided in the Brazilian Civil
Rights Framework for the Internet (Federal Law n
12.965/2014) and in the Brazilian Personal Data Protection Law (Federal Law n
13.709/2018). Consequently, all
the provisions about confidentiality, security measures and obligations in case of a
breach of security are also applied to electronic communications.
3.6 Data Protection and Digital Forensics
When it comes to digital forensics, the Brazilian Law provides specific legislation
about two main topics: (a) crimes through electronic means and (b) interception of
communication data for the purpose of investigation, detection and prosecution of
crimes.
Concerning crimes through electronic means, the Brazilian Cybercrimes Law
(Federal Law n
12.737/2012) is worth mentioning. This Act typifies crimes such as
computing device invasion providing penalties of up to 2 years of detention.
Regarding the interception of communication data for the purpose of the investigation, detection and prosecution of crimes, the relevant legislation is the Federal
Law n
9.296/1996. According to this law, interceptions may be determined “by a
judge, ex officio or upon request of: I- the police; and II- the prosecutor” (Article 3).
The Law, however, forbids interceptions when: (1) there is no reasonable indications
of authorship or participation in a criminal offence; (2) it is possible to produce
probative evidence by other means; and (3) the fact investigated constitutes criminal
offence punishable, at most, with a custodial sentence (Article 2).
Right to Privacy and Personal Data Protection in Brazilian Law
51