DATA PRIVACY. BRAZIL Demarest e Almeida Advogados

Transcription

1 DATA PRIVACY BRAZIL Demarest e Almeida Advogados CONTACT INFORMATION Luís Carlos Torres Juliana Latre Andrea Vainer Demarest e Almeida Advogados Pedroso de Moraes Street, 1201, Pinheiros, São Paulo, SP Brazil ltorres@demarest.com.br 1. Provide a brief description of the subject matter of data privacy laws in your jurisdiction that are applicable to Personally Identifiable Information, and any material obligations. Personally identifiable information protection is set forth on the Brazilian Federal Constitution, as well as on the Consumer Protection Code, on a more specific scope, regarding consumer relations. The Brazilian Federal Constitution establishes the sanctity of private life and intimacy, as set forth in its article 5, item X, and explicitly forbids breaking and entering in its article 5, item XI, proclaiming one's home to be a sacred asylum, except for the hypothesis of one being caught red-handed, urgent help being needed, or, during daytime, in compliance with a judicial determination. The interception of phone calls, mail and/or general data is also prohibited by the Brazilian Federal Constitution, as provided on article 5, item XII. The Consumer Protection Code, established by Law number 8078/90, stipulates, in its article 43, a series of rights and warranties for the consumer concerning personal information recorded in database and

2 registration files. The dispositions contained on the Consumer Protection Code intend to set boundaries and limit the use of consumer personal information by the renderer of services in an attempt to balance consumer relations. Online copy of the mentioned legal provisions: The violation of one's domicile, mail or phone communication, as well as the disclosure of one's private and/or confidential information are considered crimes, set forth on articles 150, 151 and 153, respectively, of the Brazilian Penal Code. The criminal sanction stipulated for the crime of domicile violation is detention, from one to three months, or fine. If the crime is committed by a public officer, in a situation other than those authorized by law, or not in compliance with the formalities set forth by law, or with abuse of power, the criminal sanction is increased by one third. If the crime is committed during night time, at a deserted place or with the use of violence or a weapon, or by two or more people, the criminal sanction is detention, from six months to two years, in addition to the penalty concerning the use of violence. The criminal sanction stipulated for the crime of mail or phone communication violation is detention, from one to six months, or fine. If the crime causes damage to others, the criminal sanction is increased by half. If the crime is committed by an agent of the postal service or phone service provider with abuse of duty related privileges, the criminal sanction is detention, from one to three years. Disclosing, without good cause, the contents of a private document or confidential mail, being that such disclosure causes damage to others, is also a crime, for which the criminal sanction is detention, from one to six months, or fine. The Consumer Protection Code sets forth, in its articles 72 and 73, the crimes of denying a consumer access to his/hers personal data and refusing to correct inaccurate information. Confidentiality of personally identifiable information is protected by the Brazilian Federal Constitution and only a competent judge can enforce the applicable penalties after the conclusion of due criminal proceeding. Concerning the dispositions set forth on the Consumer Protection Code, the administrative authority is the PROCON - Grupo Executivo de Proteção ao Consumidor (Executive Group for Consumer Protection). If a judicial proceeding should be commenced to investigate the crime, only a competent

3 judge can enforce the applicable penalties after the conclusion of due criminal proceeding. 2. Provide a brief description of the subject matter of data privacy laws in your jurisdiction that are applicable to Personal Health Information, and any material obligations. Personal health information can be considered part of one's intimacy and private life, for which reason it is protected by the Brazilian Federal Constitution, as provided in its article 5, item X. The secrecy of personal health information is also set forth on the Medical Ethics Code, in its articles from 73 to 79. According to such provisions, a doctor is forbidden from disclosing information of which he/she has knowledge due to duty related privileges, except in light of legal determination, good cause or with the patient's consent. Where under aged children are concerned, the prohibition is extended to the patient's parents or legal guardians, unless the non-disclosure may cause damage to the patient. Online copy of the mentioned legal provisions: The disclosure of privileged information, obtained due to professional practice, is considered a crime, set forth on article 154 of the Brazilian Penal Code. The criminal sanction stipulated for such crime is detention, from three months to one year, or fine. The health professionals that do not comply with the provisions set forth on the Medical Ethics Code, and whose actions may cause irreparable damage to a patient or to the society, may be suspended from medical practice. If a judicial proceeding should be commenced to investigate the crime, only a competent judge can enforce the applicable penalties after the conclusion of due criminal proceeding.

4 The confidentiality of all personally identifiable information, which encompasses personal health information, is protected by the Brazilian Federal Constitution and only a competent judge can enforce the applicable penalties after the conclusion of due criminal proceeding. Concerning the dispositions set forth on the Medical Ethics Code, the administrative authority is the Regional Council of Medicine, which, in case of failure in compliance, may commence specific administrative proceedings, which, in its turn, may lead to the suspension of such doctor's license to practice medicine. If a judicial proceeding should be commenced as a consequence of the administrative proceeding, only a competent judge can enforce the applicable penalties after the conclusion of due criminal proceeding. 3. Provide a brief description of the subject matter of data privacy laws in your jurisdiction that are applicable to Financial Information, and any material obligations. The Supplementary Law number 105/10 provides for the confidentiality of financial data and operations. Such law determines that Brazilian financial institutions shall maintain the secrecy of active and passive operations and banking services. Although this is the general rule, the following conducts, among others, do not constitute a breach of the duty of confidentiality: (i) the exchange of enrollment information between financial institutions, (ii) provision of enrollment information of issuers of insufficient-founds checks or borrowers in default to the entities of credit protection, (iii) communication of the competent authorities about illegal practices, including the supply of information on transactions involving funds that are bound to any criminal wrongdoing and (iv) disclosure of information with express consent of the ones involved on the operation. In addition, this law provides for the possibility of authorized breach of bank confidentiality when there's need to verify the existence of any unlawful conduct, such as, but not limited to: terrorism, illicit trafficking of narcotic substances or similar drugs, smuggling or trafficking of fire arms or materials for their production, extortion through

5 kidnapping, crimes against the national financial system, against the Public Administration or against tax and social security, money laundering and any crimes performed by a criminal organization. It is important to point out that this breach has to be authorized by a Judge during any sort of Police/Administrative Inquiry or Judicial Proceeding. It should be emphasized that the Brazilian Federal Constitution does not provide for a fundamental right to bank confidentiality. However, this right can be inferred from a general right to privacy and intimacy determined by the article 5, item X, of the Constitution. Online copy of the mentioned legal provisions: According to the article 10 of the Supplementary Law number 105/10, the breach of bank confidentiality performed outside the authorized hypotheses under this law constitutes a crime and subject those responsible for it to imprisonment from one to four years and a fine. The same article provides that the one who omits, delay or provides false information required under this Law, is subjected to the same penalties. This law also determines that the official who uses or permits the use of any information obtained as a result of a breach of confidentiality, responds personally and directly for any damages, which does not exclude the objective responsibility of the public entity, when proven that the employee was acting in accordance with official guidance. In order words, the employee and the company can be held responsible for any civil damages that resulted from the breach. It is important to point out that this Law is applicable to any financial institution in Brazil, which means banks of any kind, securities dealers, currency exchange and securities agencies, credit, finance and securities companies, real estate credit companies, credit card managers, leasing companies, credit unions, savings and loans associations, stock exchanges, entities of clearing and settlement and other companies that, due to the nature of the financial operations performed by them, will be considered by the National Monetary council.

6 According to the article 10 of the Supplementary Law number 105/10, the Central Bank of Brazil and the Securities Commission have jurisdiction for enforcement of such law and they are responsible for supervising the operations and for informing the Public Prosecutor's office of any detected trace of unlawful conduct (article 9). It should be emphasized that, although these administrative authorities are entitled to enforce the Supplementary Law number 105/10, they can not perform the breach of confidentiality by themselves, because a court order is always necessary for that to happen. 4. Provide a brief description of the subject matter of data privacy laws in your jurisdiction that is applicable to other sensitive data, and any material obligations. It is important to point out that Brazilian Legislation also protects the confidentiality of telephone and written communications. The Federal Constitution (article 5, item XII) provides that it is irrefragable the confidentiality of correspondence, telegraphic, data and telephone communications, except if there is a court order, in the cases and form provided by law, for purposes of criminal investigations and proceeding. In order to regulate this issue, there is also the Law 9296/96, which describes the proceeding that should be adopted in order to perform the breach of confidentiality in a lawful way. It should emphasized that any breach of confidentiality shall be authorized by a Court Order in order to be legal and legitimate. According to the Law 9296/96, it is a crime to intercept telephone or on line communication without a court order or to serve a goal which is not authorized by The responsible for said conduct can also be obliged to pay for civil damages cause by the unlawful action. The Brazilian Penal code also provides that it is a crime to disclose, transmit or abusively make use of telegraph, radio communication or telephone conversations between two people. The one who is found responsible for such crime can be sentenced to imprisonment from 1 to 6 months or a fine.

7 These sort of confidentiality is protected by the Federal Constitution and only the Police Authority or the Public Prosecutor can request the breach during a criminal Proceeding or investigation. Therefore, there are no administrative authorities with jurisdiction for said measure.