Statement of the Brazilian Chapter of the Internet Society on the report produced by Senator Angelo Coronel to the Draft Bill of Law 2630/2020 (PL 2630/2020)

Versão em Português  / English Version / Versión en Español

São Paulo, June 24, 2020

The Brazilian Chapter of the Internet Society (ISOC Brazil) comes to the public once again to present the following technical considerations to the report produced by Senator Angelo Coronel to the Draft Bill of Law 2630/2020 (PL 2630/2020) published on June 19, 2020. This statement reaffirms the previous one issued by ISOC Brazil, on June 9, 2020, regarding the risks of proposals that have been put forward in the Brazilian Congress to contain the spread disinformation in Brazil. The items below should be read in conjunction with important statements made by other organizations in Brazil and abroad regarding PL 2630/2020, bearing in mind its impact on the fundamental rights of Brazilian citizens, its disrespect to the Federal Constitution of Brazil and other aspects related to the social and economic development in the country. [1]

The registration of accounts in Internet applications and services should not depend on the presentation of a valid ID by users. That requirement for the use of such applications and services is exclusionary and disregards the notion that the Internet is for everyone, including those who do not have an ID card or a valid phone number, or those who do not want to identify themselves such as activists and journalistic sources. According to the Brazilian Constitution, anonymity will not impair the prosecution of illicit acts and the current Brazilian legal order does not require provisions that restrict the exercise of fundamental rights, such as freedom of expression.

The mass collection and unnecessary retention of user data raises serious privacy and data protection concerns. An increase in the collection and processing of personal data by application providers results in greater complexity of the underlying IT systems, which increases the risk of security incidents (such as data leaks and malicious attacks). The identification of users by means of their ID cards is excessive and disproportionate, contrary to the provisions of the Brazilian Marco Civil and the General Data Protection Law. The "necessity principle" in both Laws determines that the collection of data should be limited to the minimum for the accomplishment of its purposes.

Linking the operation of Internet applications and services to mobile telephony is an anachronistic and counterproductive solution. First of all, the proposal treats messaging applications and e-mail services indistinctively. The fact that some Internet applications use mobile telephony as an instrument for user registration and authentication does not make this a necessary condition for their operation. The legislator - by embracing a single technology, mobile telephony, to the detriment of all other possibilities - creates obstacles for technological innovation. Without any justification, the report extends the scope of the Law to comprise to e-mail services, which use a specific set of protocols and are functionally, operationally and technically different than any sort of messaging app.

Data localization and application blocking provisions in the Brazilian territory will lead to fragmentation of the global Internet. The Internet is an open and global network of networks. Unrestricted access to services and content produced around the world is at the DNA of the Internet. The value of the Internet is precisely that: facilitating access and communication on a global scale. Forcing services to store data in national territory render a large number of services inaccessible to the Brazilian public, simply because they do not have a legal presence in the country.

Changes proposed to the terminology adopted by the Brazilian Marco Civil are conceptually and technically wrong conceptual and create severe legal uncertainty in the Internet ecosystem. The proposed text creates non-existent technical concepts (e.g.: "nateamento") and legal definitions that do not match underlying fundamental networking concepts and protocols (e.g.: "logic gates"). These mistakes result in imprecise often inapplicable standards that will have to be observed for log retention, creating uncertainty about the expected behavior of service providers, offering risks to businesses, and rendering users without effective remedies against illicit acts. In addition to adopting erroneous and deficient definitions, the report takes CGNat (Carrier Grade NAT) for granted and ignores that such a technique subterfuge and can soon become obsolete. In this sense, the proposal to make mandatory under the Brazilian Marco Civil the registration of TCP/IP ports used in public/private address translation may not make sense in a very short time due to the growing migration to IPv6 (the solution unanimously recommended by the technical community involved in Internet governance).

In addition to keeping the unnecessary and disproportionate solution of traceability of forwarding chains, the report extends it even further to all social networks, messaging apps, and e-mail services, regardless of their presence in the national territory and the economic size of their respective provider. Traceability, under the proposed terms, cannot be reconciled with the preservation of privacy and confidentiality of communications. This will have serious implications for the use of the Internet in Brazil, whether by individuals or organizations of all sorts in the public and the private sector.

***

In view of all the problems pointed out above, we reiterate our concern with the countless technical, technological, economic, and socio-political restrictions that may affect the Brazilian society directly or as unwanted collateral effects if the proposal moves forward.

We also reaffirm our conviction that the matter under discussion should follow the model of collaborative and multi-stakeholder policy-development process used in the production of the Brazilian Marco Civil. It should entertain broad and exhaustive participation of Brazilian stakeholder groups in the activities of the Legislative Branch. We, therefore, suggest that the National Congress use open consultations and public hearings to enable the proper debate around the many controversial aspects of the report.

Finally, we emphasize that a principles-based approach is still the best way to ensure that legislative and regulatory intervention can be capable of leveraging the Internet to serve as a tool for technical, technological, socioeconomic and human development in Brazil.

[1] In this direction, see “The Senate may adopt the worst Internet law in the world” (in Portuguese): http://plfakenews.direitosnarede.org.br/; "Tell the Senators that the new report is a serious risk to rights already won” (in Portuguese): https://act.eff.org/action/pl-das-fake-news-no-brasil-diga-aos-senadores-as-que-novo-relatorio-e-um-grave-risco-a-direitos-conquistados; "Text by Senator Ângelo Coronel demands more discussion time before it is appreciated" (in Portuguese): https://direitosnarede.org.br/2020/06/02/votacao-do-pl-das-fake-news-poe-em-risco-liberdade-de-expressao-online-e-nao-pode-ser-votado-as-pressas.html.