3.7 Data Protection and Electronic Surveillance for Security
and Defence Purposes
Currently, in Brazil, there are no specific rules about the electronic processing of
personal data for security and national defence purposes. The Brazilian Personal
Data Protection Law is not applicable for processing performed for these aims
(Article 4, item III). This Law states, nonetheless, that a specific law concerning
the processing of personal data for security and national defence purposes will be
created (Article 4, §1st).
3.8 Remedies and Sanctions
In Brazil, any breach of an individual’s privacy is subject to civil liability under the
Brazilian Civil Code. In other words, if an entity or individual uses personal data
from another person without consent, this entity or individual must pay compensation for damages, whether moral or material. This remedy is reinforced by the
Brazilian Personal Data Protection Law, which imposes joint and several liability
between controllers and processors for damages caused by personal data processing
(Article 42). The new law does not make it clear whether such liability is based on
fault or shall be understood as strict liability. This is one of the main issues that
Brazilian legal doctrine is being called to address. The Law also provides administrative penalties to be imposed by the supervision authority (Article 52), such as
warnings, fines and elimination of the violated data, among others.
4 International Dimension of Data Protection
4.1 The Territorial Scope of Rules on Data Protection
The Brazilian Data Protection Law is applied to processing operations carried out by
any entity provided that: “I-the processing operation is performed in the national
territory; II- the treatment activity has the purpose of offering or providing goods or
services, or the treatment of data located in national territory; III- the personal data
for data treatment has been collected in Brazil” (Article 3). In other words, the law is
applicable to both national and international entities in the above-mentioned hypotheses, “independently of the means, the country of its headquarters or the country
where the data is located” (Article 3, caput).
Likewise, the Brazilian Civil Rights Framework for the Internet (Federal Law n
12.965/2014) provides that “any process of collection, storage, custody and treatment of records, personal data or communications by connection providers and
52
A. Schreiber
and Defence Purposes
Currently, in Brazil, there are no specific rules about the electronic processing of
personal data for security and national defence purposes. The Brazilian Personal
Data Protection Law is not applicable for processing performed for these aims
(Article 4, item III). This Law states, nonetheless, that a specific law concerning
the processing of personal data for security and national defence purposes will be
created (Article 4, §1st).
3.8 Remedies and Sanctions
In Brazil, any breach of an individual’s privacy is subject to civil liability under the
Brazilian Civil Code. In other words, if an entity or individual uses personal data
from another person without consent, this entity or individual must pay compensation for damages, whether moral or material. This remedy is reinforced by the
Brazilian Personal Data Protection Law, which imposes joint and several liability
between controllers and processors for damages caused by personal data processing
(Article 42). The new law does not make it clear whether such liability is based on
fault or shall be understood as strict liability. This is one of the main issues that
Brazilian legal doctrine is being called to address. The Law also provides administrative penalties to be imposed by the supervision authority (Article 52), such as
warnings, fines and elimination of the violated data, among others.
4 International Dimension of Data Protection
4.1 The Territorial Scope of Rules on Data Protection
The Brazilian Data Protection Law is applied to processing operations carried out by
any entity provided that: “I-the processing operation is performed in the national
territory; II- the treatment activity has the purpose of offering or providing goods or
services, or the treatment of data located in national territory; III- the personal data
for data treatment has been collected in Brazil” (Article 3). In other words, the law is
applicable to both national and international entities in the above-mentioned hypotheses, “independently of the means, the country of its headquarters or the country
where the data is located” (Article 3, caput).
Likewise, the Brazilian Civil Rights Framework for the Internet (Federal Law n
12.965/2014) provides that “any process of collection, storage, custody and treatment of records, personal data or communications by connection providers and
52
A. Schreiber