Brazil’s Fake News Bill: Congress Must Stand Firm on Repealing Dangerous and Disproportionate Surveillance Measures

This post is the first of two analyzing the risks of approving dangerous and disproportionate surveillance obligations in the Brazilian Fake News bill. You can read our second article here.

The revised text of Brazil’s so-called Fake News bill (draft bill 2630), aimed at countering disinformation online, contains both good and bad news for user privacy compared to previous versions. In a report released by Congressman Orlando Silva in late October, following a series of public hearings in the Chamber of Deputies, the most recent text seeks to address civil society’s claims against provisions harmful to privacy.

Regarding serious flaws EFF previously pointed out, the bill no longer sets a general regime for users' legal identification. Second, it does not require social media and messaging companies to provide their staff in Brazil remote access to user logs and databases, a provision that would bypass international cooperation safeguards and create privacy and security risks. Most importantly, it drops the traceability mandate for instant messaging applications, under which forwarding information would be tracked. We hope all these positive and critical changes are preserved by Members of Congress in the upcoming debates. 

However, the text of the bill also has significant downsides for privacy. Among them, Article 18 of the draft legislation will expose some users’ IDs, requiring providers to make publicly available, by default, the national ID number of natural persons paying for content that mentions political parties or candidates, as well as the name of the person who authorized the ad message. Besides the potential for harassment and retaliation based on users' political leanings, the provision creates a trove of personal data for potential political profiling using a national and unique ID number.

These can be cross-referenced with several other government and corporate databases. Even though Brazil’s data protection law sets safeguards for the use of sensitive and publicly available personal data, the stakes here are high. Government's "antifascists' ' dossiers or lists in Brazil, including names of public officials, influencers, journalists, and university teachers, revealed by the press in the last couple of years, are a serious demonstration of the problem.

The bill also establishes that internet platforms can have their activities prohibited or temporarily suspended as part of the penalties for noncompliance. According to Article 2, the draft law applies to social networks, search engines, and instant messaging service providers with over two million users registered in Brazil. Blocking entire websites and internet platforms raises many technical and fundamental rights concerns. International freedom of expression standards emphasize that even blocking just specific content  is only permissible  in exceptional cases of clearly illegal content or speech not covered by freedom of expression safeguards, such as direct and public incitement to genocide.

Yet, blocking entire internet applications as a penalty for noncompliance with the law clashes with those standards. As stressed by the UN Human Rights Committee&a