20 Oct PERSONAL DATA AND THE PROTECTION OF FUNDAMENTAL RIGHTS: A BRAZILIAN LAW PERSPECTIVE
Many thinkers maintain that we are moving to a post-anthropocentric world, in which the value of reality is extracted from constant processing of information, performed by human and non-human agents. This would be the fourth wave, or revolution, if we follow Alvin Tofler’s lessons, or in accordance with Yuval Harari, the Age of Data or “Data-ism”.
There is much to discussion about whether robots and machines should have legal personality, that is, whether they should be the holders of rights and obligations. There are several theses with multiple and various directions and conclusions.
Following French theorist Bruno Latour’s thesis that machines and robots are acting beings, just like humans, in 2017 the European Parliament issued a resolution with recommendations from the European Commission (Report 2015/2103(INL)) on the creation of a European agency for robotics and artificial intelligence, as well as an international compensation fund or insurance for accountability of intelligent machines and robots (more specifically for those derived from deep learning).
This all goes to show something we are all are already aware of: the gigantic amount of data processed in fractions of a second and, to a large extent, by automated processes (which creates a risk!). Today we talk about petabytes, exabytes, zettabytes and yottabytes.
And following Foucalt’s line, where knowledge is a source of power, it has become more than necessary to regulate and protect personal data and sensitive personal data from abuse and misuse, without delaying or hindering the integral development of society (upheld by Amartia Sen).
In that sense, the European Union has strengthened the topic of data protection, replacing the old Directive 95 with the GDPR. In Brazil, only in 2018 was enacted a specific legislation on the protection of personal data: the Brazilian General Data Protection Law, whose entry into force took place at different times, but came fully into force in August of this year (2021).
The protection of personal data in the European Union has long been regarded as a fundamental right. Examples include Article 8 of the Charter of Fundamental Rights of the European Union, Article 39 of the Treaty of Lisbon, and Article 16 (formerArticle 286 of the TEC) of the Functioning Treaty of the European Union.
In Brazil, on the other hand, the understanding that the protection of personal data is a fundamental right was not so simple and clear until recently. This is because the Federal Constitution of 1988 does not establish explicitly and literally in this regard.
From this the question that arises (or that has arisen): is it necessary to insert data protection as a fundamental right in our Constitution?
Subsections X, XII and XIV of Article 5 directly provide for the protection of privacy, private life, the right to information, and the right to confidentiality of communication and data. In addition, article 5, LXXII establishes a modality of access and rectification of personal data, the habeas data.
But there is no express provision in the Federal Constitution that the protection of personal data is a fundamental right. And for this reason, some decisions in the past have not followed this trend.
This is the case of RE 418.416-8, 2006, reported by Minister Sepúlveda Pertence, who recognized the inexistence of a guarantee of inviolability of data stored in computers based on constitutional guarantees. According to the reporting justice, the decision protected the secrecy of communications, but not the data itself.
It seems to us that this decision would have already gone against the understanding adopted by the Brazilian government itself in 2003. Item 45 of the Santa Cruz de La Sierra Declaration, final document of the XIII Ibero-American Summit of Heads of State and Government, signed by the Brazilian Government on November 15, 2003, which mentions the fundamental right nature of personal data protection.
With time and the influence of comparative law, it can be said that doctrine and case law have changed their position. Through a harmonic and systematic reading of the Brazilian constitutional text, the protection of personal data started to be seen as a fundamental right implicitly stated.
Some authors, following the European trend, argue that data protection derives from personality rights and is inserted in the principles of individual freedom, privacy, intimacy and free development of personality provided in Article 5 of the Federal Constitution.
This is because, “the protection of personal data is an indirect way of achieving an ultimate goal, which is the protection of an individual”, according to Danilo Doneda.
Such statement is based on the principle of informational self-determination, which according to Italian jurist Stefano Rodotà, is the right to maintain control over your own information and to determine how to construct your own private sphere.
This was the position of Justice Rosa Weber, reporting judge, of ADI 6387 (2020).
Even Justice Gilmar Mendes, in the same ADI 6387, sustained that “the idea that the parameters for the protection of fundamental rights must be permanently open to technological evolution has never been strange to the constitutional jurisdiction.
In parallel, there are those who sustain that the protection of data derives from the principle of human dignity, enshrined in Article 3 of the Federal Constitution. As a general clause of protection of the person, the principle is always carried out observing the freedom, identity, equality, integrity and privacy of the person.
Even though there is no direct provision in the Federal Constitution, it seems to me that today the protection of personal data is considered by Brazilian doctrine and case law as a fundamental right. In this context, I return to the question posed above: is it necessary to insert data protection as a fundamental right in our Constitution?
It seems so. And simply to avoid a change in the interpretation of the courts that might somehow hurt the individual liberties and privacy of the people in this world of hyperconnectivity.
It is enough to see the attempt of the Union’s General Attorney, when manifesting for the rejection of the precautionary measure object of the aforementioned ADI 6387, when commenting on another decision of the STF (the 2016 ADI 2859 – federal rules regarding the secrecy of operations of financial institutions), in which the Supreme Court has already decided that the “transfer of secret data from a certain holder, who has the duty of secrecy, to another, who maintains the obligation of secrecy’ does not offend the right to intimacy and privacy.”
And in this context, the Proposal for Constitutional Amendment No. 17 was drafted in 2019, whose goal is to amend the Federal Constitution to include the protection of personal data among the fundamental rights and guarantees (Article 5, XII) and to fix the private competence of the Union to legislate on the protection and processing of personal data.
The bill has already passed through the Chamber of State Representatives and is currently in the Senate for approval. If the wording at the Senate is approved without changes, the wording of the PEC should be promulgated, thus altering the Federal Constitution.
Despite the consolidated understanding (doctrinaire and case law) that data protection must be seen as a constitutional and fundamental right, it is extremely important that the Brazilian government takes this step, demonstrating, internationally, that the issue of data protection is essential to the country.
Without certainty about this, it will be more difficult to move forward with safety and security for people in an increasingly connected world.
This article is intended exclusively to provide information and does not contain any opinion, recommendation or legal advice from Kestener & Vieira Advogados concerning the matters herein addressed. Copyrights are reserved to Kestener & Vieira Advogados.
No Comments