BrazilMarco Civil da Internet, Protection of Records and Personal Data
Lei nº 12.965/2014 (Marco Civil da Internet), arts. 7º, 10, e 12
In force since .
A personal data rule binding private bodies.
- Obligation class
- Security, Disclosure
- Audit expectation
- none
What it requires
- Preserve the intimacy, private life, honor, and image of the parties involved when retaining or disclosing connection records, application-access records, personal data, or the content of private communications.
- Disclose a connection or application-access record associated with personal data or other identifying information only under a judicial order.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 12, II states a fine of up to 10% of the economic group's revenue in Brazil in its last fiscal year, excluding taxes, for a violation of articles 10 or 11, with no separate fixed cap stated; a foreign company's Brazilian branch, subsidiary, office, or establishment answers jointly and severally for the fine.
- Rule
- Turnover pct only
- As of
- Currency
- BRL
- Turnover percentage cap
- 10
What it makes you log
Who may demand the log
Court
What the log must hold
Access record
Logging duty
Article 10 governs how connection and application-access records are kept and when they may be disclosed. The duty to keep them (Articles 13 and 15, with their one-year and six-month periods) and the bans on keeping them (Articles 14 and 16) sit in sections this row does not cite, so no retention is coded. Article 11 on the reach of Brazilian law over records is likewise not a provision this row covers.
- Kind
- Explicit
- As of
- Provision
- Lei nº 12.965/2014, art. 10, caput and § 1: the keeping (guarda) and disclosure of connection records and application-access records must preserve the privacy, private life, honor and image of the parties, and the provider need disclose them only on a judicial order.
- Trigger
- personal_data_processing
What this law does
Article 7 assures an internet user rights including inviolability of intimacy and private life, secrecy of the flow of their internet communications except by judicial order, and secrecy of their stored private communications except by judicial order.
Article 10 requires that the retention and disclosure of connection and internet-application-access records, personal data, and the content of private communications observe the intimacy, private life, honor, and image of the parties involved, and article 10, § 1º limits disclosure of records associated with personal data or other identifying information to a judicial order.
Article 12 authorizes a warning, a fine of up to 10% of the economic group's revenue in Brazil in its last fiscal year, excluded taxes, temporary suspension, or prohibition of activity for violations of articles 10 and 11, which extend Brazilian law and these privacy, personal-data, and communications-secrecy rights to any collection, storage, custody, or processing of records, personal data, or communications where at least one such act occurs in Brazilian territory, including where performed by a foreign company that offers a service to the Brazilian public.
These duties bind an internet application provider regardless of how it collected the records, personal data, or communications, including by scraping, so long as at least one act of collection, storage, custody, or processing occurs in Brazilian territory.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .