violation of data protection laws
In July 2015, a federal judge in Rio Grande do Norte determined the block of “Tudo sobre Todos”, a website that published and commercialized personal data of Brazilian citizens. According to the judge, there is violation of legal provisions that protect privacy and personal data (the Federal Constitution, the Civil Marco Internet and the law of Positive Credit).
BLOCKING ORDER
- Judicial Body
- 1st Federal Court of Rio Grande do Norte
- Judge
- Magnus Augusto Costa Delgado
- Date of Decision
- July 29th 2015
- Type of Block
- Indefinite period
- Authors of the request
- Federal Public Ministry
- Case Number
- 0805175-58.2015.4.05.8400 (PJE
IMPLEMENTATION
OF THE BLOCK
- Addressee
- Internet connection providers
- Starting date
- [not specified]
- Ending date
- N/A [block is still ongoing]
- Affected
- tudosobretodos.se
ORDER LIFTING
THE BLOCK
- Judicial Body
- N/A
- Judge
- N/A
- Date of Decision
- N/A
- Case Number
- N/A
CASE ANALYSIS
Facts
The website http://tudosobretodos.se made availiable and commercialized personal data of Brazilian citizens, with information such as the tax payer’s unique number, data of birth, relatives, neighbors, alternative addresses and social networks . With only the name, any person could have access to a vast quantity of personal data. But not all information was available for free, existing a system of buying credits to access more data of third parties. According to what was informed, the data was obtained through register offices, published judicial decisions, official gazettes, forums, information bureaus, social networks and consultations on public websites online. The website emphasized that such data was “public information”.
The website is organized in a complex manner: it is based on the Seychelles Islands, its domain name registered in Sweden (.se), it allegedly uses servers in France and the identity of the domain registrant is occult by a register “seeker” (proxy). Additionally, the website uses CloudFare (a Content Distribution Network – CDN) in order to have protection against Distributed Denial-of-Service attacks (DDoS) and to improve the efficiency of the data delivery. The company Top Documentos LLC is presented as the owner, informing that its territories are located in France.
Plans of access to other data are offered, bought via PayPal or Visa, Master and American Express credit cards, with plans ranging from R$9,99 for 10 credits costing R$0,99 each, R$24,90 for 30 credits, costing R$0,83 each and R$79,00 for 100 credits, costing R$0,79 each.
Considering the publishing of personal data without the consultation and consent of its owners a violation to the constitutional rules of right to intimacy, private life and personal data, the Public Attorney’s Office filed a Preparatory Cautious Action against the company TOP DOCUMENTOS LLC. The following injunction requests were made: (i) that backbone access administration companies insert technological obstacles that impair the access to the “Tudo sobre todos” website in all national territory until the definite judgement of the process; (ii) that companies that administer the Fixed Commuted Telephonic Service and the Personal Mobile Service insert technological obstacles that impair until the definite judgement the access to the website in the country; (iii) to solicitat to the Kingdom of Sweden the provisory removal of the website on the Internet, which is hosted in the top-level domain (TLD) of the country, also informing to the judge the complete data of the natural person that created and maintain it, IP numbers, access logs and email addresses.
Procedural History
The judge accepted the Action, determining that the companies Embratel, Rede Nacional de Ensino e Pesquisa, Oi, ComsaBrasil, Level 3 Comunicações, AT&T, Mundivox, Uol, Telefônica, Algar, Tim and companies that administer the Fixed Commuted Telephonic Service and the Personal Mobile Service block the access to the website in the Brazilian territory until the definite judgement of the matter.
Legal Grounds
When accepting the requests, the judge argued that the posting of personal data made by the website in a platform of great exchange of information, without the authorization of the owners, violates the rights and individual guarantees of the Constitution, mainly the rights to intimacy and to private life of article 5, item XX. Additionally, he based his position affirming the violation to the basic rights of the Internet user described in Law 12.965 of April 23rd 2014, the Brazilian Internet Civil Rights Framework, mainly in articles 3, 7, items I and VII, article 10, caput and paragraph 1, article 11, paragraph 2. He also identified a violation to the Law nº12.414/2001, the law of Positive Register, which defines that the posting and commercialization of personal data can only used for the specific purposes to which they were collected. Considering the quick dissemination of information and the great risks of damages due to the dissemination of such data, he concluded to the necessity of making a rapid combat, granting the injunction.
It was determined for the companies that administer the access services to backbones and companies that administer the Fixed Commuted Telephonic Service and the Personal Mobile Service to put technological obstacles that prevent the access to the website in the country, until the definitive judgement of the matter.
Lastly, the judge determined that through the Department of Recovery of Assets/National Secretary of Justice/Ministry of Justice of Brazil, it should be solicited to the Kingdom of Sweden the provisory removal of the website and the complete data of the natural persons that created it.