Brazil’s access rates remain below average compared to many North American, European and even some Latin American countries like Argentina, Chile, Costa Rica and Uruguay.1 Some 67 percent of households had access to the internet in 2018, while 70 percent of people accessed the internet in the past three months, according to the most recent study by the Brazilian Internet Steering Committee (CGI.br). There has been a notable growth in cable and fiber optic use in recent years. On the other hand, 20 percent of households with internet still reported connection speeds under 5 Mbps.2

Mobile penetration has grown significantly and mobile broadband connections have quickly become a primary means for Brazilians to access the internet. Some 56 percent of users accessed internet exclusively via mobile phone.3 However, there has been a slight drop in the number of mobile subscriptions over the past years.4 The number of smartphones with 4G services has increased since it was introduced in April 2013, but 4G availability remains lower than the global and South American average.5 The quality and speed of 4G services in Brazil have also improved, though better results are concentrated in wealthy urban centers in the Southeast, such as Belo Horizonte, Rio de Janeiro and São Paulo.6

The use of public access points is still low, but has increased in the past three years, thanks to the expansion of free Wi-Fi hotspots and public policies promoting free internet access in public spaces, mainly urban areas.7 Brazil’s telecommunications regulator, the National Telecommunications Agency (Anatel), registered over one million hotspots in Brazil in 2016.8

Brazil’s federal government has implemented a number of internet expansion and improvement programs since 2010, including the National Broadband Plan (Plano Nacional de Banda Larga or PNBL).9 Although there have been improvements in internet access since its launch, the PNBL was criticized by civil society organizations for the low quality of broadband connections offered at popular prices.10 Critics also noted the plan’s lack of coverage and poor conditions in rural areas.11

In 2017, the Ministry of Science, Technology, Innovation and Communications launched a public consultation for a new national connectivity plan – called Internet para Todos (Internet for All) – to expand access to underserved areas and increase fixed and mobile broadband infrastructure in the country.12 The plan seeks to provide satellite broadband connectivity to underserved areas in the country via Brazil’s first defense and strategic communications satellite launched in May 2017.13 After a lengthy legal dispute, in May 2019 the contract between state-owned Telebrás and Viasat was finally approved to continue to roll out high-speed internet services via the satellite.14 The companies said that over 3,000 schools were connected as of May, benefiting students especially in rural or remote areas.15 The satellite was also used to provide connectivity to rescue teams dealing with a deadly mining disaster in the city Brumadinho after a dam collapsed.16

Geographic and socioeconomic disparities in internet access persist in Brazil. Recent studies show that internet use is lower in rural areas (49 percent) and the North and Northeastern regions (64 percent), as well as among lower-income groups.17 Price is considered a main barrier: in 2018, 61 percent of households that did not have any access said it was because it was too expensive.18

Various obstacles continue to prevent many households from accessing the internet, such as high prices charged by service providers and telecommunication companies — a problem that extends to fixed broadband, wireless, and 3G and 4G technologies — and persistent social inequalities.

Limited mobile plans that include zero-rating agreements for unlimited access to certain platforms are common in Brazil. Some observers viewed this as a contributing factor in the spread of disinformation via WhatsApp during the 2018 elections.19

In 2018, the national telecommunications regulator, Anatel, stated it may allow the blocking of TCP/IP ports of “home providers” who share their residential connections.20 According to the regulator, this would not violate the net neutrality principle. In Brazil, sharing internet connections is a common practice, particularly in poorer neighborhoods.

The government does not place limits on bandwidth, nor does it impose control over telecommunications infrastructure. There have been no reported instances of the government cutting off internet connectivity during protests or social unrest.

A recent judicial trend resulted in orders to block communications apps for not fully complying with information requests as part of criminal investigations, although no new cases emerged during the past year. In 2015 and 2016, service providers temporarily blocked WhatsApp on three occasions in compliance with judicial orders (see B1).21 There was also a judicial threat to block Facebook in March 2018 if the platform failed to swiftly remove "false information of criminal content” related to the murdered politician Marielle Franco, but the order was not implemented.22

Concerns have been raised regarding the army’s authorization to use “jammers” during the Olympic Games and other operations.23 According to authorities, the use of such equipment would primarily target drones,24 but using them to block cellphones was not discarded. 25 The measure was criticized for the lack of transparency (the act that authorized the army to use jammers was deemed “secret”) and the absence of specific legislation regulating their use.26 The armed forces were also authorized to use jammers during Independence Day celebrations on September 7, 2018.27

Over the past decade, private backbone infrastructure, such as that of Oi, GVT and Embratel, has expanded in Brazil.28 In 1998, the state-owned company Embratel, which was responsible for building the internet backbone, was privatized and acquired by the U.S. company MCI; it was later acquired by the Mexican telecom América Móvil in 2003.

Internationally, undersea cables connect to Brazil from North America and Europe. In April 2017, the Spanish and Brazilian governments confirmed plans to build the first undersea fiber optic cable linking Brazil to Europe.29 Some of the impetus for building these connections is related to a desire to avoid reliance on U.S. infrastructure after revelations of pervasive U.S. spying on Brazilians in 2013,30 although there are still ongoing projects to construct cables connecting Brazil to the United States.31

In 2004, the Brazilian Internet Steering Committee (CGI.br) launched an initiative called PTT Metro to create internet exchange points (IXPs) across Brazil, starting with their first IXP in São Paulo. Currently, Brazil has at least 25 IXPs installed in the country.32

Although there are no significant legal or economic barriers for companies competing in the ISP, mobile, or digital technology sectors, the Brazilian ICT market is highly concentrated. Three large private companies — Oi, Claro and Vivo (Telefônica Brasil) — represent nearly 80 percent of the country’s broadband market.33 Four large private companies — Vivo, TIM, Claro, and Oi — hold almost 98 percent of the mobile market.34 Such high market concentration could make it very difficult for other providers such as Algar and Nextel to compete in the mobile sector.35

Regional ISPs are responsible for almost 20 percent of the broadband market share in Brazil, but they face several challenges to grow, particularly due to a high amount of taxes they have to pay.36 In 2018, some states started to reduce taxes applicable to local ISPs. The measure was less well received by big telecommunications companies claiming that it threatens competition.37

Another challenge relates to the prices of broadband connections from the biggest telecommunication corporations which themselves compete with smaller providers in some markets. They are incorporated in the final price that is then transferred to the user in the last mile.

Organizations supporting the development of community networks in the country also face challenges, particularly due to excessive bureaucracy to register and the spectrum management policies in place.38

In March 2017, the Senate passed a bill prohibiting data caps on fixed broadband,39 after an announcement in March 2016 that ISPs would impose data caps on broadband internet had caused uproar among users, politicians and internet-dependent businesses.40 The bill then proceeded to the House of Representatives.41 It had not yet been approved as of mid-2019.

Two regulatory agencies oversee Brazilian ICTs: the Brazilian Agency of Telecommunications (Anatel) and the Administrative Council for Economic Defense (CADE), an antitrust agency that is focused on reviewing mergers and anticompetitive practices in telecommunications markets.42

Anatel is administratively and financially independent, and not hierarchically subordinate to any government agency. Its decisions are only subject to judicial review in national courts. From the Ministry of Communications, Anatel has inherited the powers of granting, regulating, and supervising telecommunications in Brazil, as well as much of its technical expertise and other material assets.

Anatel has received some criticism for aligning with private interests. In 2016, Anatel initially backed policies establishing data limits on home broadband internet, but backtracked in the midst of public criticism. Recently, the consumer protection lawyer and civil society representative at CGI.br, Flávia Lefèvre, commented on Anatel’s possible bias towards private interests in discussions of a bill that seeks to reform the Telecommunications Act.43 A study from 2015 found that many of Anatel’s former regulators joined the telecommunications industry following their mandates.44

The government also created the Brazilian Internet Steering Committee (CGI.br) in 1995, a multi-stakeholder independent organization in charge of coordinating and integrating all internet service initiatives in Brazil, as well as promoting technical quality, innovation, and the dissemination of services. Provisions in the Civil Rights Framework for the Internet (Marco Civil da internet) mandate that the government consult with CGI.br, and in various instances directly involve the Committee, in policy-making and implementation of Marco Civil processes, but a clear mechanism has not yet been established.

CGI.br is formed by government officials, as well as private sector representatives, civil society, and the science and technology community.45 CGI.br’s contributions include comprehensive and reliable annual reports on internet use in Brazil, funding for internet governance-related research, and the promotion of conferences such as the annual Brazilian Internet Governance Forum. In June 2009, CGI.br declared the “Principles for the Governance and Use of the Internet,” which include online freedom, privacy, human rights, and net neutrality as a foundation for the Brazilian information society.46 Many of these principles were adopted into Brazilian law through the Marco Civil in 2014.

In April 2019, the government issued a decree abolishing several participatory spaces in the Federal government. The announcement raised doubts as to how it would affect CGI.br.47 However, according to CGI.br member Flávia Lefèvre, a government representative said the CGI.br would not be affected.48 In 2017, there was an outcry after the government proposed a public consultation to advance significant changes in CGI.Br’s representation and election mechanisms, without prior dialogue with the multi-stakeholder community. Some critics said the government had sought to increase its control over the CGI.49 Following these events, CGI.br itself proposed a broader public consultation with representatives of various sectors at the end of 2017 and continued to support a multi-stakeholder approach.50

There are no proven indications that Brazilian authorities are filtering messages or engaging in widespread blocking online. Social networks, communication apps, and video-sharing platforms such as Facebook, Twitter, YouTube, Vimeo, and Vevo are — for the most part — freely accessible and widely used in Brazil.

There were no new orders to block WhatsApp during the past year, following a series of such cases in 2015-2016. Since 2015, judges have asked telecom companies to temporarily block access to WhatsApp on four occasions for failing to comply with information requests as part of criminal investigations. A first order issued in February 2015 was suspended before the app was blocked,51 and three subsequent shutdowns were implemented in December 2015, May 2016, and July 2016.52 WhatsApp has argued that it could not provide information it did not have, and that such requests to turn over information are technically impossible given its current end-to-end encryption system.53

Lawsuits and legal threats have been frequently used, particularly by politicians and political authorities, to restrict the circulation of content criticizing them. Certain legal provisions criminalizing defamation and blasphemy and restricting speech around elections continue to put constraints on content online. Brazilian cybercrime legislation also limits certain online content.54

During the 2018 election campaign, ABRAJI recorded at least 500 attempts by Brazilian politicians to hide critical social media posts, online news articles or blogposts. Jair Bolsonaro was deemed the “champion” of such judicial actions, with 31 cases identified. In half of the cases, judges reportedly ruled in favor of removing the content. In some of these cases, requests also sought to prevent the future publication of certain content. Most of these requests cite defamation or electoral legislation. Some 70 percent of reported cases targeted content on Facebook.55

In the run-up to the 2018 general elections, several initiatives sought to tackle the proliferation of offensive or false information online. A resolution on electoral propaganda issued in December 2017 was used to order the removal of content disclosing "facts that are known to be untrue" about candidates.56 In June 2018, the Superior Electoral Court (TSE) issued its first decision on the matter and gave Facebook 48 hours to remove several posts linking presidential candidate Marina Silva to corruption investigations.57

Censorship measures against journalists and decisions to remove journalistic content continued to be reported during the coverage period:

• In August 2018, the Syndicate of Journalists of Paraná denounced a judicial order against several online sites to remove reports linking the president of a state bank to the Operation Car Wash corruption investigation.58
• In November 2018, the National Association of Newspapers reported on a court order against journalist Marcelo Auler, requesting him to remove two entries from his blog referring to the involvement of military police soldiers in crimes such as extortion via kidnapping and home invasion. Police officers also demanded compensation of 30,000 Brazilian reals ($7,547) each for the publication.59
• In April 2019, Justice Alexandre de Moraes revoked his decision to order the removal of two stories from websites O Antagonista and Crusoé after it sparked heavy criticism.60 The report had referred to the Supreme Court minister, Justice Dias Toffoli, in the context of the Operation Car Wash corruption investigation.61

Between January and June 2018, Google received 338 government requests for content removal, most of them for defamation (156) and privacy and security (132).62 During this period there was a request for removing two news blogs with critical content against the government of a city in Pará; they were offline for two weeks until the judge decided only defamatory content should be taken down. Facebook’s Transparency Report indicates that 2,000 pieces of content were restricted between January and June 2018, “in compliance with orders from local courts related to civil, criminal, and electoral proceedings” – the affected content increased compared to 2017.63 The government issued 42 removal requests to Twitter during the first half of 2018.64

Brazil’s Marco Civil da Internet, known as the “Internet Constitution,” has clarified issues related to intermediary liability to protect freedom of expression, grant due process, and prevent prior censorship, establishing that service providers are only held liable for third party content if they fail to remove content after a specific court order.65 Despite boasting some of the most comprehensive legislation on digital rights, Brazil’s Marco Civil was used as a key argument for disproportionate orders to block WhatsApp. Bills in Congress have proposed to restrict the power of judges to order blockings of such magnitude.66

In response to the spread of disinformation during the 2018 election campaign, social media companies took a more proactive role to remove accounts and pages that evidenced “coordinated inauthentic behavior” and violated their terms of service.67 Some of these actions prompted concern from civil society organizations and activists given the lack of transparency and due process mechanisms. In July 2018, Facebook said it had removed a network of 196 pages and 87 accounts that were being used by a right-wing activist group “for the purpose of sowing division and spreading misinformation.”68 Facebook’s action led the most affected group to demand the Supreme Court to order a presidential norm regulating which content could or could not be removed from online platforms.69 The request was denied. Again, in August, Facebook removed 74 groups, 57 accounts, and five pages for violating its real name and spam policies.70

In October, during the second round of presidential elections, WhatsApp banned several accounts after reports alleged that the platform was being illegally used by Jair Bolsonaro’s campaign (see B5).71 In January 2019, WhatsApp decided to globally restrict the possibility of forwarding messages through its app to a maximum of five groups or individuals in response to the spread of misinformation.72 Although the measure was suggested by some Brazilian academics during elections, it may also have repercussions for users’ freedom of expression.73

Meanwhile, several legislative proposals seeking to address fraudulent content sparked criticism from digital rights groups. In March 2018, a controversial proposal on combatting fake news would have made intermediaries liable if they failed to remove flagged content within 24 hours, without judicial authorization.74 This proposal was dismissed, but similar bills were still in the works (see C2).75

The WhatsApp blocking orders in 2015-2016 resulted in two legal actions at the Constitutional Court; the Supreme Federal Court held its first public hearings on the matter in June 2017.76 A claim for violation of constitutional rules (Arguição de Descumprimento de Preceito Fundamental) argues that the decisions to block WhatsApp were illegal because they breached the right to communication and disproportionately affected millions of consumers and internet users.77 On the other hand, a Direct Unconstitutionality Action (Ação Direta de Inconstitucionalidade), argues that the Marco Civil’s provisions used for the blockings are illegal under Brazilian constitutional law. Article 12 of the Marco Civil establishes sanctions for violations of Articles 10 and 11, which require application providers to disclose the content of private communications exclusively under judicial orders. Some critics argue that a “temporary suspension” would violate the same right to communication established by the Constitution. Several experts have argued that Article 12 of the Brazilian Marco Civil does not allow for the entire blocking of sites and applications, but only concerns data collection and treatment activities mentioned in Article 11.78

Intermediary liability issues have been settled by a case law established by the Brazilian High Court of Justice (STJ) and by statutory provisions enacted by the Marco Civil in 2014. In recent years, case law was slowly built around a similar understanding, with the Brazilian STJ ruling towards a judicial notice-and-takedown model.79 Exceptions were made for copyright infringement and “revenge porn,” such as dissemination of sexually explicit photos or videos without the consent of the individual appearing in them. In cases pertaining to revenge porn, the user’s notification alone is enough to make the intermediary liable, should it refuse to make the content unavailable in a short time.80

In November 2016, the Superior Court of Justice (STJ) unanimously ruled that the “right to be forgotten” cannot be imposed on search engines such as Google.81 However, in May 2018, STJ changed its view on the matter, when in a lawsuit against Google, Yahoo!, and Microsoft, it granted the “right to be forgotten” to a public prosecutor whose name appeared in search results associated with fraud allegations in a public tender. The decision argued that the information on the prosecutor that appeared in search results was “overcome by the course of time.”82 Although four bills to create a so-called “right to be forgotten” were proposed in Brazil’s Congress, by which search engines would be required to remove links to personal data upon requests by users, legislative proposals had yet to be debated.83

Threats and violence against online journalists and independent bloggers in certain areas of the country have contributed to pockets of self-censorship (see C7).84 The climate of intimidation escalated during the polarized election campaign which saw President Bolsonaro’s rise to power, as both the leader and his followers launched online attacks against critics.85 Harassment and boycott campaigns targeted around 700 artists, journalists and intellectuals, as their names were distributed in WhatsApp groups days after the election.86 Threats and retaliation against the media have had a chilling effect – several journalists interviewed by Reuters in November 2018 said that they started to tone down criticism to avoid backlash by the government or violence from supporters.87 The President’s declarations against LGBTI, indigenous groups and others have also raised concerns.88

Social media was a prominent playing field for political campaigning during the 2018 elections, as new rules allowed sponsored political advertisement online.89 Despite efforts to prevent and curtail the spread of fake news,90 disinformation proliferated on various platforms, notably WhatsApp. Several reports emerged regarding abuses in the use of social networks and communications platforms by political campaigners. Moreover, the spread of disinformation continued following the election period (see B8).

According to the mission of international observers sent by the Organization of American States (OAS), the spread of disinformation in the country was an “unprecedented” phenomenon mainly because of the use of private communication platforms.91 Several abuses were reported, including the misuse of WhatsApp to send bulk-messages to multiple numbers obtained through scraping software obtained online.92 A study analyzing 110 open groups on WhatsApp also detected evidence of total or partial automation in the sharing of messages and images.93

On October 18, Folha de S. Paulo reported that Jair Bolsonaro was benefiting from a network of big businesses using undeclared funds to disseminate pro-Bolsonaro messages via WhatsApp.94 Bolsonaro denied the accusations, qualifying the bulk messaging as “voluntary support.”95 The scheme was denounced to the electoral court and remained under investigation.96 In June 2019, Fernando Haddad’s team renewed demands to investigate alleged illegal campaigning, after new evidence emerged regarding Brazilian companies contracting a Spanish marketing agency to promote political messages in favor of Bolsonaro on WhatsApp.97 Although there is no hard evidence of Bolsonaro’s involvement, undeclared donations are considered illegal according to Brazilian electoral law. The use of automation software to spread messages is also prohibited.

Candidates and elected authorities were also key in spreading disinformation online. Bolsonaro’s son Flávio, who was elected senator in 2018, was central in pointing out an alleged fraud in the electronic voting system that would benefit Fernando Haddad in the first round. His brother Eduardo, also a senator, supported the information even after the electoral court said it was false.98 In a climate of great polarization, such messages heightened tensions surrounding election results.

Brazil lacks a regulatory framework around the use of public funds for state advertisement in media outlets, including online media. Discriminatory use of state advertisement for political control remains a concern at the federal and local levels in Brazil.99 In 2017, the institution responsible for monitoring information about state advertisement was closed.100

During his electoral campaign, Bolsonaro threatened to cut off state advertisement from a newspaper that had been reporting on irregularities in his campaign.101 After taking office, he said that the government would cut advertisement to media as a strategy to guarantee independence. These declarations came in conjunction with criticism against the press for its “partiality.”102

While historically much of the advertising budget has been directed at TV, priority has increasingly shifted to online platforms. In February 2019, according to Folha de S. Paulo, TV channels aligned with Bolsonaro’s government complained about the lack of state advertisement.103 In April 2019, however, quarterly data showed a 63 percent increase in advertisement expenditures, compared to the previous year. The main beneficiary was a TV channel led by a bishop, which explicitly supported Bolsonaro during his campaign.104

Ever since the approval of the Marco Civil, the net neutrality principle has been incorporated into Brazilian law. Enacted in May 2016, a new decree regulating the Marco Civil solidified the rules that prohibit the discrimination or degradation of traffic for commercial purposes, while permitting it for emergency and public calamity situations.105 Any notice of violation of said principle by companies may be investigated and sanctioned.106 However, zero-rating is still a common practice among mobile internet companies.107

Many Brazilians are dependent on online sources of information, mostly via social networks and chats. Social networking platforms have become important instruments for citizen journalists and others to access information, defend civil rights, and express political points of view in Brazil. Brazilians can read news from national and international sources without government restriction. Within such a diverse media landscape, some content providers are neutral and others show bias towards or against the government.

However, many users have limited access to information beyond social media platforms given the widespread practice of zero-rating agreements for mobile plans.108 According to a recent study mapping news producers in Brazil, some areas of the country have limited or no local news coverage, especially in the north and northeastern regions. By January 2019, around 50 percent of Brazilian municipalities (covering 30 million people) did not have any local news media outlets, either online or offline. Some 30 percent of municipalities (covering 34 million people) had only one or two outlets.109

Social media platforms such as Facebook and Twitter – and more recently closed messaging platforms such as WhatsApp – play a central role in civic activism in Brazil. However, the widespread use of these platforms to mobilize around political causes is also confronted with campaigns to spread disinformation and hoaxes. Starting in May 2019, thousands of students and academics protested government cuts in funding for education, many of them flocking to social media to express their outrage.110 At the same time however, researchers pointed to coordinated efforts on WhatsApp to discredit public universities.111

Citizens increasingly engage with formal government platforms to express opinions and shape the design and implementation of legislation.112 A new app called Mudamos+ was designed in 2017 as part of an initiative by Instituto Tecnologia e Sociedade (ITS-Rio), in partnership with the Movement Against Electoral Corruption (MCCE). The open-source app uses Blockchain technology to create a secure way to propose and sign popular initiative bills, creating a potentially strong tool of direct democracy through the internet. A bill was proposed in Congress to legitimate electronic signatures in popular initiative bills, which would enable Mudamos+ and similar apps to become legitimate forms of participation.113

The Brazilian Federal Constitution forbids anonymity but protects freedom of the press and freedom of speech, including cultural and religious expression.114 Brazil made noteworthy progress in establishing a foundation for internet user rights with the passage of the Marco Civil, signed into law in 2014.115 The groundbreaking legislation establishes the right to freedom of expression online, offers detailed privacy protections pertaining to personal data, guarantees net neutrality, and promises to uphold the participatory nature of the internet. A decree regulating the Marco Civil was enacted in 2016, containing specific rules regarding net neutrality and data protection.116

However, several competing legal provisions, such as laws criminalizing defamation and blasphemy and restricting speech around elections, continue to threaten users’ rights online. Multiple attempts have been made at the legislative level to change and weaken guarantees on freedom of expression, privacy, and access to the internet. Concerns continued in 2019 with proposed “fake news” and anti-terrorism legislation (see C2).117 To respond to and resist multiple draft bills, civil society organizations engaged in digital rights created a coalition in 2016 that has been actively monitoring and engaging with Congress on these issues.118

The court system has been commonly used to demand the removal of critical content about politicians and businesspeople (see B2 and C3). Moreover, recent actions by the Supreme Court were criticized for undermining judicial independence and freedom of speech. In March 2019, the president of the Supreme Court launched a confidential investigation into “fraudulent news” and threats against the top court and its members.119 On April 15, the court ordered the removal of a report from the website O Antagonista and magazine Crusoe, which alleged a link between the president of the Supreme Court and people involved in the Operation Car Wash corruption scandal. Following public outcry, the court reversed the decision on April 18. The decision noted that the document that was referred to in the news piece actually did exist.120

Impunity for crimes against communicators continues to be a serious issue, according to human rights organizations.121 Most investigations and prosecutions still only target the direct perpetrators of crimes, allowing planners and other accomplices to escape justice.122 In September 2018, communicators were included in the human rights defenders’ protection program together with environmentalists.123 The measure was welcomed by press freedom groups, though deemed insufficient to address structural violence against journalists.124

Brazil has continued to see instances of local officials suing bloggers and online journalists for defamation, which is a crime punishable by six months to two years in prison or a fine according to the penal code.125 In June 2019, the government enacted a reform to the Electoral Code that establishes a two to eight year prison sentence for anyone falsely accusing a political candidate for the purpose of affecting his or her candidacy; though President Bolsonaro vetoed a provision that would have equally punished anyone disseminating the false accusations via any means.126 In August, however, Congress rejected his veto.127 Lawmakers have proposed to extend criminal penalties for honor offenses online – there were at least three draft bills on the subject in Congress.128

In the run-up to the 2018 general elections, a series of legislative proposals also sought to criminalize the dissemination of false news. According to Agência Pública, some 10 draft bills were proposed in the first four months of 2018 alone.129 Proposed penalties ranged from small fines to up to eight years of imprisonment.130 These proposals raised considerable concerns among digital activists and experts and raised red flags as to the potential mechanisms for censorship and misuse.131 While they were archived at the end of 2018, some of these proposals were relaunched and continued to be discussed.

Although people are rarely charged or imprisoned for racist or discriminatory speech, Brazilian law establishes penalties ranging from two to five years in prison for practicing or inciting discrimination based on race, ethnicity, or religion in the media or in other publications.132 The Criminal Code further outlines punishment for vilifying or mocking religion, with penalties ranging from one month to one year in prison, although it is unclear whether these penalties have been applied online.

Brazilian cybercrime law criminalizes breaches of digital privacy such as computer intrusion, the “installation of vulnerabilities,” and editing, obtaining, or deleting information—including credit card numbers—without authorization. The distribution, sale, production, or offer of programs or devices meant to facilitate these actions, or to interrupt ICT services, are also categorized as crimes.133

Concerns have also been raised about proposed anti-terrorist legislation. There are around ten bills pending approval to amend the existing law.134 Two draft bills notably propose to criminalize incitement of a broadly defined concept of terrorism, with penalties that would reach up to eight years of imprisonment.135 One of them specifically mentions online media.

Online journalists and bloggers reporting on uncomfortable topics frequently receive legal threats, including lawsuits for defamation. A prominent case involving criminal defamation concerned journalist and blogger Cristian Góes, who was convicted of defaming a state court judge in 2013. The complaint regarded a fictional story in which he criticized structural abuses of power by local authorities in Northeast Brazil. His seven-month prison sentence was later commuted to community service. In September 2018, he was reportedly ordered to pay compensation to the judge in the region of $15,000.136

A number of users were sued or detained for their online activities during the past year. Comedian Danilo Gentili was condemned to six months in prison in April 2019 for injury against federal deputy Maria do Rosário, because of a video published in 2017 tearing an extrajudicial notification from her apart and rubbing it in his genitals. The notification requested him to remove posts against her from his Twitter account. The judge argued the video was not a humorous piece, but was made with a clear intention to injure. The case raised a debate regarding the proportionality of criminal penalties when it comes to violations of freedom of expression. However, Gentili himself has criminally sued people for offenses against his honor.137 On November 9, 2018, police took sports blogger Paulo Cezar de Andrade Prado into custody to serve a sentence for criminal defamation. He was condemned over a blog post, after being sued by the sports commentator Milton Neves.138 Paulinho was released on December 23, after more than one month of detention. It was not the first time the journalist was arrested. In 2015, he was also sentenced on defamation charges, and was in jail for 130 days.139

The Brazilian Constitution explicitly forbids anonymity.140 Although in practice, anonymous speech online is common, judges have occasionally referred to the constitution as a basis for limiting certain instances of anonymous speech. Other judges, however, have upheld anonymous speech on the grounds that it is important for free expression and privacy, ruling that anonymous posts online are protected as long as it is possible to technically trace the speech through IP addresses. The Brazilian Superior Court of Justice (STJ) has held that identification through IP address is a “reasonably effective means for identification” and corresponds to “average diligence” expected from internet providers.141

Several legal provisions also place restrictions on anonymity in Brazil. Real-name registration is required for individuals or legal entities in order to purchase mobile phones or to access private internet connections, although the use of pseudonyms in discussion forums across the web is quite common. Lawmakers have pushed for restrictions on anonymity with regard to public access points such as LAN houses in order to prevent cybercrimes. Legislation of this kind already exists in states such as São Paulo,142 and a bill under consideration would oblige cybercafes to maintain updated records of their users, including full name, date of birth, and identity document number.143 Other proposed bills aim to oblige users to identify when accessing the internet or social media.144

Brazilian law does not place restrictions on encryption, but in 2018 a draft bill proposed to oblige internet companies to provide encryption keys for law enforcement authorities.145 Law enforcement authorities have also increased pressure to access encrypted content for criminal investigations. Court orders to block the encrypted communications app WhatsApp in 2015 and 2016 questioned at the Supreme Court, which held a public hearing on encryption in 2017.146 Law enforcement representatives defended the company should cooperate in investigations even if this would imply changing the app’s architecture or encryption protocols. Government hacking has been raised as an option for access to encrypted content by law enforcement authorities on different occasions.

Brazil has a history of surveillance abuses of private communications, particularly targeting social movements and activists. Despite the existence of several safeguards in the telephone interception law n. 9.296/1996, there are concerns regarding their judicial interpretation and implementation.147

Infiltration through online platforms and political monitoring of social networks are common practices and there is still no legislation regulating online personal data gathering by law enforcement authorities and intelligence agencies.148 During 2013 demonstrations, police and intelligence forces monitored online personal data and social media activity of people who participated in the protests, affecting their rights to privacy and freedom of expression.149

Civil society organizations have continuously denounced the lack of transparency on how the government uses surveillance, which is frequently justified as a tool to combat crime.150 The Brazilian government has continued to increase its capacity for surveillance using major events, such as the August 2016 Olympics Games, as justification. In response to an information request, the Ministry of Defense reported it had spent 68 million Brazilian reals ($21 million) between 2014 and 2016 on surveillance equipment.151 There is little clarity on how these technologies are being used since the end of the Olympic Games.152

Brazil has no regulation on the use of malware for lawful surveillance practices, however leaks from Hacking Team showed the Brazilian Federal Police was authorized to use its software to infect 17 targeted phones.153 Evidence emerged about the use of NSO Group’s Pegasus (a spyware that allows almost complete control of an infected mobile device) in Brazil between August 2016 and August 2018.154 The software is supposedly only sold to governments.

Digital rights advocacy organizations have largely supported new data protection legislation. On July 10, 2018, the Senate approved the General Data Protection Act (Bill 53/2018), which former President Temer signed in August.155 However, the president vetoed several items of the text, presenting a new version for them in December 2018. Affected items included the creation of an independent National Data Protection Authority (DPA) which was introduced in the text with more limited autonomy.156 After review by Congress, the law still provides that the DPA will be subordinate to the office of the president, although the legal nature of this administrative body may be reviewed within two years.157 During congressional discussions, new exceptions for data protection rules were added to the initial law. Changes were approved in July 2019.158 The new rules will regulate the use, protection, and transfer of personal data such as name, address, email, age, marital status, and property status, but it does not apply to the use of intelligence and law enforcement authorities of citizens’ personal data. Bolsonaro vetoed several of the changes approved in July, including protections for the personal data of citizens who required access to information and the sanctions of partial or total suspension of data operations and processing if in violation of the law.159 The latter veto was overturned by Congress in September.160

The Marco Civil imposes obligations on internet connection providers to keep records of their users’ connection logs for 12 months, and for application providers to keep records of access for six months.161

Regulations decreed on May 11, 2016 clarified security measures to be taken by providers regarding log-keeping, including how authorities must request users’ data from intermediaries, the level of technical security said intermediaries must adopt to safeguard logs from being leaked, and other identification and security procedures to be undertaken by the professionals responsible for handling said data, such as the obligation for individual identification and for the use of two-factor authentication.162

Other retention measures are present in the Brazilian legal framework beyond Marco Civil. Law 12.850 on organized crime obliges telecommunications companies to retain data regarding the origin and destination of phone calls for five years.163 Anatel resolutions also establish obligations on the retention of metadata by landline and mobile service providers.164

Threats, intimidation, and violence against online journalists and bloggers constitute a major restriction on freedom of expression and human rights in Brazil. Hostility against journalists and the media has escalated in a context of deep polarization.165 In August 2018, radio journalist Marlon Carvalho de Araújo was murdered in his home in countryside Bahia. He was known for the videos he shared in his Facebook profile, criticizing and denouncing local politicians.166

Intimidation and harassment also remain a serious concern in Brazil. In early 2019, there were cases of academics, politicians, and activists leaving the country to protect themselves from online attacks and threats. This was the case of elected congressman Jean Wyllys,167 who gave up his mandate in the federal government, and Márcia Tiburi, a philosopher and writer who ran for state elections in Rio and reported having received death threats.168 In March 2019, President Bolsonaro was criticized for his Tweets accusing a female journalist and the press of wanting to ruin his son’s political life and his own government.169 Flávio Bolsonaro was elected Senator, but is under investigation for money laundering and the accused reporter was covering the corruption scandals involving him. According to an investigative journalists’ organization and Brazil’s bar association, this was an attempt to intimidate media outlets and journalists.170

During the elections, newspaper Folha de S. Paulo requested the Federal Police to investigate threats against its journalists after publishing a report about illegal private support for misinformation campaigns against candidate Fernando Haddad.171 In July 2019, UN experts expressed concern about death threats against journalist of The Intercept Brazil, Glen Greenwald, and his family (including his husband, Brazilian lawmaker David Miranda), following the publication of information regarding wrongdoings by the current Minister of Justice when he was responsible for the case against former president Luiz Inácio Lula da Silva, who was imprisoned in 2018.172

During the 2018 election campaign, several cyberattacks against political groups and journalists were reported. In September 2018, the Facebook group “Mulheres Unidas contra Bolsonaro” (Woman United against Bolsonaro) had its name and content changed to support the candidate, and its moderators started to receive direct threats. The group had one million participants and millions of participation requests. The administrator’s personal Facebook and WhatsApp accounts were also hacked.173 Journalist Patrícia Campos Mello was also targeted after she signed a news report on possible illegalities on Jair Bolsonaro’s campaign.174 Some of her messages were deleted and pro-Bolsonaro messages were sent to her contacts.

Governmental entities also received attacks. In September, a system from the Ministry of Defense was attacked and personal data of generals Eduardo Villas Boas and Hamilton Mourão, now the vice president, were exposed. The action was claimed by Anonymous Brazil as an act of protest.175 The state Secretary of Agriculture and Supply and City Hall of São Gonçalo, in Rio de Janeiro were also affected by an Anonymous attack in October.176

In January 2019, a few days after the collapse of a dam which resulted in more than 200 deaths in the city of Brumadinho, Minas Gerais, an attack exposed internal documents from the mining company Vale, which was responsible for the mine. The information included data on accidents and incidents registered in their operation zones. Vale denied the attack saying the documents released were already public, but they did not indicate where.177

Brazilian authorities have made some efforts to increase cybersecurity and invest more resources in overcoming current obstacles. Since 2008, Brazil has engaged in a multi-stakeholder debate to develop its cybersecurity agenda, which resulted in the opening of a National Cyber Defence Command, and a National School for Cyber Defence aimed at preparing military personnel for the use of cyber tools on national defence.178