Privacy and International Compliance: When Differences Become an Issue

This paper introduces key issues to the balance between data collection policies and privacy protection initiatives in an internationally unstructured legal framework. The right to privacy has been addressed and construed differently among jurisdictions, which leads to uncertainties regarding the cross-boarding data collection operations that often occur in the cyberspace. This paper focuses on the jurisprudence of the Brazilian Supreme Court, demonstrating (i) that the traditional approach given to privacy in Brazil is not accurate enough to deal with the new threats which arise in the cyberspace; (ii) that the concept of privacy should be redefined when applied to the cyberspace and; (iii) that differences among national privacy legislations challenge international compliance with regard to the right to privacy. The traditional concept of privacy of the Brazilian Supreme Court In the last ten years, the Brazilian Supreme Court has been mostly confronted with the right to privacy in cases related to bank secrecy and wiretapping. These are cases that require the Brazilian Chief Justices to define under which circumstances privacy violations can be considered lawful. As every other fundamental right, privacy cannot be construed in an absolute way and violations might be accepted when safeguarding the public interest or the public order. Criminal persecution is a great example of this since privacy cannot exclude the conduction of investigation proceedings. If privacy did not have any limitations, one could never be searched. Having faced the right to privacy in such cases, the Brazilian Supreme Court has formulated an interpretation 1 In order to define the traditional concept of privacy applied by the Brazilian Supreme Court, a research has been made regarding the decisions which contained the keywords “privacy”, “intimacy” and “private life” in the last ten years (from 1998 until 2008). which is mainly based on the approach of a negative liberty. In this sense, the right to privacy only entitles individuals to prevent others from interfering in their private sphere of life. According to this interpretation, privacy violations occur whenever facts or elements which belong to one’s private sphere of life are arbitrarily accessed or disclosed. Although useful in some cases, this concept does not define what is within the boundaries of the so called private sphere of life, making it difficult to draw the line between what is protected and what is not. Thus, each violation is considered separately and the focus is on the level of intimacy present in the collected information. The increasing number of activities that take place on the internet brings to the cyberspace a considerably high amount of information about its users. Being difficult to define which data are public and which data are private, the applicability of the Brazilian Supreme Court’s concept of privacy becomes problematic in the cyberspace for the following reasons: a-) “Violation-oriented” approach: this interpretation privileges a right to resist or to avoid arbitrary interferences in an individual’s life. Hence, the right to privacy only serves the purpose of protecting people against possible violations. This approach is not sufficiently accurate to protect internet users from data collection since their data are often collected clandestinely, making it hard for the users to exercise their right of protection. If privacy is a right to resist and not a right to control, how can a user resist something that he/she is unaware of? Violations can be fought only when they are known. Taken as a mere right to resist, privacy does not fulfill the needs of internet users, whose data are mostly silently collected (spywares, cookies, web bugs, phishing, etc.). If the notion of control over personal information is not incorporated into the concept of privacy, violations will keep occurring without being fought.