Brazilian government accused of selling citizens’ personal data

Diogo Rodriguez . Jun 07, 2018

Brazil needs more personal data protection.

Federal prosecutors in Brasilia are investigating whether the Federal Data Processing Service (Serpro), a state-owned IT processing firm, has been selling the personal data of Brazilian citizens without their consent. The prosecutors argue that information such as social security numbers, tax return statements, electoral information, date of birth, and the name of citizens’ parents are being sold to other public institutions.

During a three-month investigation, prosecutors found that prices for data ranged from USD 72,000 to 260,000. State Prosecutor Frederico Meinberg Ceroy says that the commerce of personal data was a multi-million dollar business. The list of institutions that allegedly bought this data includes the Comptroller-General’s Office, which is supposed to ensure transparency in government, and the National Justice Council – the Supreme Court’s watchdog.

Prosecutors have sent a long list of questions to Serpro in order to understand what exactly was going on. However, the institution never bothered answering them. Instead, the data processing firm released a statement denying any wrongdoing – but not disclosing who its clients are. If the accusations are proven to be true, it will be the <a href="https://www1.folha.uol.com.br/colunas/ronaldolemos/2018/06/governo-e-acusado-de-vender-dados.shtml">first time</a> in history that a national government has been caught leaking its citizens’ personal data for cash. <h3>Public data available for free</h3> This is by no means, however, the first leak involving Serpro. Back in March, the Federal Prosecution Office <a href="https://g1.globo.com/df/distrito-federal/noticia/site-de-consulta-a-cpf-e-telefones-e-derrubado-da-internet.ghtml">asked</a> for the website Consulta Pública to be brought down by the administrator of .BR domains – those operating in Brazil. The website allowed anyone to access private data – such as social security numbers, addresses, and phone numbers of millions of Brazilians. Both cases might even be linked, according to investigators. <h3>Personal data protection laws in Brazil</h3> Brazil’s Congress has been discussing <a href="https://www1.folha.uol.com.br/tec/2017/12/1945134-brasil-deve-ter-lei-de-protecao-de-dados-so-no-fim-de-2018-dizem-especialistas.shtml">data protection legislation</a> since 2013. The idea is to create a specific authority that will regulate the extraction and use of Brazilian citizens’ personal data on the internet. Three bills related to the subject are being discussed, as <a href="https://brazilian.report/2018/03/21/personal-data-treatment-brazil/">wrote</a> Frederico Meinberg Ceroy to The Brazilian Report. They are: Bill No. 4.060/2012, sponsored by congressman Milton Monti, which defines treatment as any operation – with or without automated processes – for storing, ordering, conserving, updating, comparing, evaluating, organizing, selecting and extracting personal data. On the other hand, Bill No. 5.276/2016 considers treatment of data as any operation with personal data. In the Senate, Bill No. 330/2013, sponsored by senator Antônio Carlos Valadares, used to define treatment of data as any operation related to personal data. The project has been changed by the Senate’s Science and Technology Committee, which updated the concept by defining the treatment of data as any operation with data. Currently, <a href="https://brazilian.report/2018/03/21/personal-data-treatment-brazil/">data protection</a> is regulated by a plethora of <a href="https://brazilian.report/2018/03/21/personal-data-treatment-brazil/">laws and norms</a> dealing with the treatment of data, such as the Consumer Defense Code, the law creating a Good Payers’ Database, the Access to Information Act, the Internet Legal Framework, and a decree regulating it. The Consumer Defense Code grants citizens access to the information gathered about them and their sources. The <a href="https://brazilian.report/2018/05/14/brazil-congress-data-privacy/">Good Payers’ Database</a> laws were passed to facilitate credit in Brazil. The idea was that once banks knew exactly who pays their bills on time, general interest rates could be lowered. The Access to Information Act characterizes the treatment of data as a set of actions related to producing, receiving, sorting, using, reproducing, transporting, transmitting, storing, evaluating, and controlling information. While citizens are entitled to data from public offices and officials, individual privacy and rights must be preserved. Meanwhile, the Internet Legal Framework talks about the treatment of data several times but it does not define what it is. A 2016 presidential decree regulated the Civil Rights Framework for the Internet, defining personal data as any data related to identified (or identifiable) persons – including ID numbers or electronic IDs, when they are related to a person.

Read the full story NOW!

Start your 7-day free trial

Diogo Rodriguez

Rodriguez is a social scientist and journalist based in São Paulo.

YOU SHOULD ALSO READ

Brazil On The Record Issue #2 — Follow what the Brazilian government is doing

Brazil’s new data protection legislation, explained

How Brazil’s legislation sees the treatment of personal data

Sensitive personal data protection in Brazil

Diogo Rodriguez