Brazil’s “Marco Civil” Law Has Added Clarity to Internet Liability

In the past year and a half, Brazil has taken significant steps towards enacting a comprehensive legal framework to govern internet use and data security. Many questions remain to be answered, particularly about the final form of regulations and the impact they will have both within Brazil and on foreign businesses operating there.

But it is clear that this set of new laws is an important development for Latin America in the area of internet and privacy law. The new laws are already shaping and changing the liability regime for internet intermediaries, and the jurisprudence in this area is sure to continue to evolve substantially. Internet intermediaries will have to integrate these changes and uncertainties into their business models and risk analyses — and be prepared to evolve.

How Marco Civil Came to Pass

On April 23, 2014, Brazil passed the landmark Law 12.965, the Marco Civil da Internet or Brazilian Civil Rights Framework for the Internet (the “Marco Civil”). The law has been in progress since 2009, when it was conceptualized through a partnership between the Ministry of Justice (Ministério da Justiça), and the Center for Technology and Society of the Law School at the Fundação Getulio Vargas. In its own words, it establishes “principles, guarantees, rights, and obligations for the use of the Internet in Brazil” and “provides guidelines” for all levels of Brazilian government to follow when regulating this use.

The Marco Civil has been followed by two related legislative projects that are being developed in a collaborative process that has invited public participation: a decree law to further implement the Marco Civil through regulations and a data protection law, the Lei para a Proteção de Dados Pessoais or, the Law for the Protection of Personal Data (the “Draft Bill”). Both legislative projects try to strike a balance between protecting individual freedoms and creating a stable and open commercial environment.

Liability of Internet Intermediaries

While it is too early to make predictions about the long-term impact of Marco Civil, both the civil rights and business communities have raised questions about whether the framework will achieve its goals. For internet intermediaries, the new law promises to clarify and limit the scope of their liability vis-à-vis consumers, but the initial applications of the Marco Civil to intermediary liability cases raise concerns about whether intermediaries will in practice have more protection or predictability in this area.

The term “internet intermediary” encompasses various kinds of internet service providers, each of which has different liability risks. The Brazilian Superior Court of Justice has understood the term to include infrastructure providers, internet access providers, providers of hosting services for the storage and remote access of information, information providers who create information available on the internet and content providers that make available the information created by information providers or by internet users. Victims of harmful internet activity often claim against the intermediaries for providing a platform or serving as a channel for such activity.

In the recent years before the enactment of the Marco Civil, Brazilian courts have taken a range of approaches to the question of intermediary liability, including, in certain high-profile cases, taking measures against intermediaries that have been criticized as being disproportionate and highly disruptive. In 2007, after YouTube failed to remove a compromising video of a Brazilian supermodel, a São Paulo state court issued an order that led to the suspension of its service throughout the country by Brasil Telecom. In 2012, after Google failed to remove videos critical of a certain mayoral candidate, a judge in Mato Grosso do Sul issued an arrest order for the head of Google in Brazil and ordered the suspension of Google for 24 hours.

These extreme cases aside, the Brazilian courts have followed three paths on intermediary liability. The first is to hold that internet intermediaries have no liability for the conduct of its users. This approach treats the intermediary as a passive, content-neutral channel for information with no responsibility for its impact. The second approach is to apply strict liability to internet intermediaries. Under this theory, the intermediary is in a commercial relationship with the consumers of its services (which may be paying for them directly or indirectly) and the harm to a consumer is a defect in the provision of services for which the intermediary should bear full responsibility. The third approach is fault-based liability, which can mean liability for either non-compliance with the request of the victim to take down harmful content, or non-compliance with a court order to remove the content.

Impact of the Marco Civil

Intermediary liability was one of the most debated topics in the drafting of the Marco Civil, which in its final version contains provisions meant to address, in a manner favorable to the intermediary, the uncertainty created by these various approaches for two kinds of internet intermediaries: internet service providers (ISPs) and application providers.

With respect to ISPs, the Marco Civil adopts the no-liability approach. Article 18 of the Marco Civil states that the provider of connection to the internet shall not be held liable for the for civil damages resulting from content generated by third parties. With respect to application providers, the Marco Civil applies fault-based liability for non-compliance with court orders. Article 19 states that the provider of internet applications can only be subject to civil liability for damages resulting from content generated by third parties if, after a specific court order, it does not take steps to make unavailable through the application the content identified as unlawful within the time period stated in the order.

It is important to note that application providers are free to institute policies requiring the removal of content in other circumstances and that the Marco Civil’s provision does not mean that the intermediaries will only remove content upon the issuance of a court order. Rather, the law removes the risk to intermediaries of being liable for non-compliance with the request of users or other parties. Furthermore, the Marco Civil creates exceptions to this rule for copyright infringement and for “revenge porn.”

Despite these provisions in the Marco Civil that are favorable to intermediaries, the immediate application of the law by local judges suggests that intermediaries may still experience variable treatment in Brazilian courts. In a highly publicized case from February 2015, a judge invoked the Marco Civil to order ISPs to block access to the internet application WhatsApp throughout Brazil as part of an effort to compel WhatsApp to cooperate with local police in an investigation. While the decision was reversed by an appellate court, it cast doubt on whether the Marco Civil will afford reliable protection to service providers and companies doing business in Brazil.

The answer to this question will emerge and perhaps also shift in the coming years, through the further interpretation and application by Brazilian courts of the Marco Civil’s intermediary liability regime, and the finalization of its regulations.

Photo: Cayambe via Wikimedia Commons