On April 23, 2014, during the launch of NETMundial, the Global Multistakeholder Meeting on the Future of Internet Governance, President Dilma Rousseff sanctioned the bill that creates the Internet Legal Framework. The bill had been debated in the House of Representatives on the basis of constitutional urgency since September 2013 and was approved by the Senate without changes. The bill, designated as Law no. 12,965/14, will come into force in late June.

The new law affects net neutrality, freedom of speech, the liability of providers for user-generated content, privacy, and the retention of logs. Additionally, a number of important aspects of the law will affect the day-to-day operations not only of companies based in Brazil or having a subsidiary in the country but also companies based abroad that deal with Brazilian internet data.

Net neutrality
The law creates the concept of net neutrality, expressly requiring equal treatment of data packages within Internet traffic. The exceptions are still to be detailed, which gave rise to debates in the House of Representatives plenary session.

The principle of neutrality stipulates that companies shall not be allowed to determine access based on content. Although they can continue to offer different packages, with different access speeds and data volumes, they cannot prioritize specific services or applications in prejudice of others.

Possible exceptions may prioritize emergency services, public security, and other matters of national interest – and may be related to the technical feasibility of service provision – but are not permitted to benefit companies and clients. The Brazilian National Communications Agency (ANATEL) and the Internet Steering Committee (CGI) will be consulted with respect to the regulation of exceptions.

Privacy 
The new law is imbued with sections and provisions intended to guarantee the privacy of users and the protection of personal data, all in accordance with the Federal Constitution, the Consumer Defense Code, the Copyright Bill of Law, and Decree no. 7,962/13, which regulates electronic commerce.

The use of a user’s data must be clearly explained by companies that provide services to the user via the Internet, including future or third-party use of the data. This is applicable even to companies based abroad that market their products and services to Brazilian customers over the Internet without a local presence.

According to the law, any contracts that restrict access to the judiciary shall be deemed null, reinforcing the applicability of the Consumer Defense Code to such online relationships. Furthermore, content providers such as social networks and others must keep access logs for six months and are not allowed to retain any data related to those occurrences of access.

Freedom of expression and liabilities
Companies that operate in the digital world will now be backed by a higher degree of legal certainty. The new law assures freedom of speech, clarifying the consequences of violations of rights by third parties.

For example, internet services (or access) providers shall not be held responsible for user-generated content. The content (or application) provider shall be held accountable only if it does not comply with a request to withdraw offensive content within a determined timeframe when notified by a court.

An exception – in which notification can be issued by the offended party or representative, without the requirement of a court order – exists for the specific cases of images of nudity or sexual acts.

The application of the general rule to content protected by copyright will depend on the issuance of a specific statute: the much-awaited new Copyright Act. It will follow the principles of the Federal Constitution and assure freedom of speech.

Data retention 
The new law also establishes that Internet service providers – the companies responsible for providing Internet access to users – shall keep users’ connection logs for one year, in confidence and in a controlled environment.

The purpose of such measure is to enable the identification of users who commit crimes in the online space, provided that the data may be requested only by a court order, police authority, or the Public Prosecutor’s Office.

Access providers are personally responsible for such retention, and this obligation cannot be assigned to third parties.

Data centers 
A previous version of the bill contained an express requirement for the creation of data centers within the country and the corresponding retention of data from Brazilian users in Brazilian territory. This requirement was removed from the final version of the Law.

One of the primary objectives of the previous bill was to allow quick access to offenders’ data – which must still be stored.

Another objective was to promote business in the Brazilian technology sector. Technical difficulties in establishing the data center infrastructure, however, as well complaints from certain market sectors, led Congress to reconsider the requirement. Companies will not be required to invest in such infrastructure in Brazil, as long as the data are accessible if judicially required.

The verdict
The Law still has to be regulated by presidential decree, and any possible gaps, gray areas, or sections with the potential to lead to misunderstanding are likely to be clarified.

Already, however, it is considered to be ground-breaking and innovative, bringing certainty to relations established over the Internet. In the words of World Wide Web inventor Sir Timothy Berners-Lee, the Law “reflects the Internet as it should be.”