Mapping Laws on Government Access to Citizens' Data: Brazil
New money laundering law in Brazil (Federal Law 12683/2012):
A specific provision allows the police and public prosecutors to demand certain user registration data from Internet providers directly, via a simple request, with no court order, in criminal cases involving money laundering:
"Article 17-B. Police authorities and public prosecutors shall have access, exclusively, to registration data of the suspect that disclose personal qualification, father and mother names and address, independently of judicial approval, kept by the Electoral Justice, by phone companies, by financial institutions, by Internet providers and by credit card companies".
Bill 6578/2009 regulates criminal organizations.
This bill was recently amended to include similar provisions regarding data disclosure:
“Art. 15. Police authorities and public prosecutors shall have access to registration data of the suspect that disclose personal qualification, father and mother names and address, independently of judicial approval, kept by the Electoral Justice, by phone companies, by financial institutions, by Internet providers and by credit card companies".
This bill also states that it is a crime to refuse to disclose such data:
“Art. 21. Failing to disclose or omitting registration data, records, documents and information requested by judges, public prosecutors or police authorities, in the course of an investigation or lawsuit: Penalty - imprisonment for a minimum of 6 months, up to a maximum of 2 years, and a fine.”
Bill 4666/2012, which modifies article 13 of the Brazilian Criminal Procedure Code, intends to allow the federal police to demand registration data of Internet users, remove any need for court orders or judicial oversight:
“Art. 13. Police authorities shall have the duty of:
V – demand registration data of Internet users, in cases of crimes investigated by the Federal Police.”
Marco Civil solution, with judicial oversight:
On the judicial request for logs
Article 17. Interested parties may, for the purpose of gathering evidence in civil and
criminal proceedings, of either accidental or autonomous nature, request a judge to order
the party responsible for storing Internet service access logs, or connection logs, to
disclose these logs.
Sole Paragraph. Without prejudice of other legal requirements, the application shall contain, under penalty of not being admissible:
I – solid evidence of the occurrence of an illegal act;
II – a motivated justification for the utility of accessing the requested logs, for the
purposes of investigation or the gathering of evidence;
III – the period that the logs refer to.
Article 18. It is the obligation of judges to take the measures necessary to guarantee the secrecy of the information received, and the preservation of the intimacy, private life, honor and image of Internet users. Judges are capable, for that purpose, to constitute the information as secret, including with respect to requests for the storage of logs.