Despite Progress, Metadata Still Under "Second Class" Protection in Latam Legal Safeguards

This post is the fourth in a series about our new State of Communications Privacy Laws report, a set of questions and answers about privacy and data protection in Argentina, Brazil, Chile, Colombia, Mexico, Paraguay, Panama, Peru, and Spain. The research builds upon work from the Necessary and Proportionate Principles—guidelines for evaluating whether digital surveillance laws are consistent with human rights standards. The series’ first three posts were  “A Look-Back and Ahead on Data Protection,” “Latin American Governments Must Commit to Surveillance Transparency,” and "When Law Enforcement Wants Your Private Communications, What Legal Safeguards Are in Place in Latin America and Spain?." This fourth post adds to the third one, providing greater insight on the applicable standards and safeguards regarding communications metadata in Latin America and Spain.

Privacy advocates are working to undo antiquated and artificial distinctions between privacy protections afforded to communications “content” (the words written or spoken) and those provided to “metadata”. Metadata, such as the identification of parties engaged in communication, IP addresses, locations, the time and duration of communications, and device identifiers, can reveal people’s activities, where they live, their relationships, habits, and other details of their lives and everyday routines. As EFF, Article19, and Privacy International stated in PIETRZAK v. Poland before the European Court of Human Rights, “‘metadata’ is just as intrusive as the content of communications and therefore must be given the same level of protection.” Yet domestic privacy laws often treat metadata as less worthy of protection compared to the contents of a communication. Such distinctions were based on artificial analogies to a time when telephone calls used pulse dialing, and personal computers were a rarity. 

International human rights courts are starting to become more sophisticated about this. The EU Court of Justice stated: 

“that data, taken as a whole, is liable to allow very precise conclusions to be drawn concerning the private lives … such as everyday habits, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them… In particular, that data provides the means … of establishing a profile of the individuals concerned, information that is no less sensitive, having regard to the right to privacy, than the actual content of communications.” 

 Similarly, in the case Escher et al v. Brazil, the Inter-American Court of Human Rights recognized that the American Convention on Human Rights applies to both communications content and metadata.