This article presents a comparative analysis between jurisdiction in Brazil and in the USA in two relevant cases given their impact on internet application and technology companies.
On one hand, in Brazil, the technology companies that provide internet application services (such as Google, Facebook, Youtube, etc.) and have headquarters abroad, face issues regarding the interpretation of the Brazilian laws, especially as to the compliance with court orders to submit the contents of private communications stored in their servers.
On the other hand, in the USA, North American technology companies also face issues such as the requisitioning of email content from these service providers, whereas the content of the private communications are stored in servers abroad.
In Brazil, a Direct Motion of Unconstitutionality was filed before the Brazilian Supreme Court under number 51/2017, for the constitutional review of Decree No. 3810/2001 that enacted the Mutual Legal Assistance Treaty between Brazil and the United States, examined below.
In the USA, there is the case United States versus Microsoft, in progress before the USA Supreme Court. The case debates whether email services providers, which have the control over their users personal data, have the legal obligation to disclose the content of electronic communication, even if the material is stored in servers located outside of the USA.
The Federation of the Associations of Information Technology Companies ("ASSESPRO NACIONAL") filed a declaratory motion of constitutionality (Adcon No. 51/2017 to have Federal Decree No. 3.810/2001 declared constitutional. This Federal Decree enacted the Mutual Legal Assistance Treaty in Criminal Procedures between Brazil and the United States of America. Under this legal statute, a letter of request must be issued in cooperation processes between Brazilian and USA authorities in matters of criminal investigation, prosecution, and crime prevention.
According to the technology company association that filed the motion, many Brazilian courts are not applying the said Decree. That is why the Association filed the direct motion of constitutionality, as it is the proper legal instrument to review the constitutionality of the decree and, thus, its practical application by the Brazilian Courts. The only case in which the Decree should not apply is if it is found to be unconstitutional, which has not yet been declared by the Brazilian courts.
What is happening is that the technology companies with headquarters in the USA that provide internet application services (such as email, social media, digital advertising, etc.) in Brazil are being mandated by the courts to submit the contents of private communications between their users. If they fail to comply with such court orders, the internet application providers are held civilly liable, with the application of severe fines, and criminally liable for the crime of contempt of court.
They argue that internet application providers headquartered in the United States are subject to the laws of that country. In this regard, the laws of the USA impose strict limits to the delivery by internet application providers of the contents of private communications between their users (such as emails).
The argument presented in the case ADCON No. 51 is that, by failing to apply Decree No. 3810/2001, the Brazilian courts are violating the constitutional principles of sovereignty, confidentiality of private communication, the due process of law, equality, and free enterprise.
The Plaintiff also claims that the Brazilian Internet Regulatory Framework does not exclude the application of international treaties to which Brazil is party to. In the present case, the Mutual Legal Assistance Treaty, in the form of Decree No. 3810/2001, is deemed to be a formal law, as it has been received by the Brazilian legal system.
Facebook joined the action as amicus curiae (ADCON No. 51). It claims that its activities are subject to the Electronic Communications Privacy Act. This North American law forbids the disclosure of the content of private communications stored by the electronic communications services providers, notwithstanding the exceptions set in the law itself.
According to the company Facebook Brasil, it does not have managerial control over the data of the company Facebook Inc., based in the United States. Facebook Brasil only voluntarily provides information to Brazilian authorities in case of emergency (risk of death and/or severe bodily harm to a person). Therefore, Facebook Inc. is governed by the United States laws, as is headquartered in that country.
It also claims that the contents of private communications cannot be directly provided to Brazilian authorities, except with a court warrant issued by a U.S Court. According to the company, U.S law does not allow internet application providers to disclose the content of private communications directly due to a Brazilian court order, otherwise the company may be held liable for violation of the U.S law.
Another question is if it is possible to extend the application of Brazilian laws and the Brazilian jurisdiction to companies with headquarters abroad and, respectively, given the sovereignty of the foreign State.
In sum, the case portrayed in ADCON No. 51 is interesting as it deals with the constitutional principles of sovereignty, independence of States, international cooperation, principle of territoriality of jurisdiction, due process of law, and the rights to communication and to privacy of communication.
As for the United States of America, the case of United States V. Microsoft Corporation is in progress before the American Supreme Court. This case regards the possibility of the United States government obtaining, through court orders, the contents of private communications, such as emails, stored in computers/servers/datacenters located outside of that country.
The original case refers to a drug-trafficking criminal investigation, in which the Government requested an order for Microsoft to disclose email information. Microsoft refused to deliver the content of the email, claiming that it changed the email storage location to Ireland, and that the Stored Communications Act cannot be applied outside of U.S territory.
Here is an excerpt from the original brief filed by Microsoft before the U.S Supreme Court: "Whether a United States provider of email services must comply with a probable-cause based warrant issued under 18 U.S.C 2703 by making disclosure in the United States of electronic communications within that provider's control, even if the provider has decided to store that material abroad". According to the U.S government, grounded on 18 US.C 2703, authorities from that county may require electronic communication providers to disclose the content of communications.
In contrast, Microsoft claims that the American law on electronic communications is applicable only to acts committed within U.S territory. It argues that the Stored Communication Act focuses on protecting the safety of private communications, hence the trust that users have that the electronic communications providers safely store the content of their communications in electronic servers. It also claims that it offers services such as MSN, Hotmail, and Outlook, storing thousands of user emails in data centers located in over 40 countries.
According to Microsoft, the U.S. Congress did not signal that the Stored Communications Act should be applied outside of U.S territory. Thus, a order to copy and import communications stored in foreign territory is an illegal and extraterritorial application of the Stored Communications Act.
Also, according to Microsoft, the Stored Communications Act comprehends solely communications stored in the United States, as the focus of the statute is to protect electronic communications stored and avoid the disclosure of private communications. So, the focus on the disclosure of electronic communications is contrary to the original intent of the American legislators.
The conclusion: "For now, the presumption against extraterritoriality limits the SCA, and the warrant issued under it, to communications stored on U.S. soil". Moreover, the U.S Congress may update the Stored Communications Act, considering the conflict between the application of the law and international relations with other countries, the privacy of citizens, and the competitiveness of the technological industry.
The European Union, the United Kingdom, New Zealand and Ireland have requested participation in the case United States x Microsoft by filing an amicus curiae brief.
So, as an illustration of the above, the European Union claims that the proper procedure would be to consider the internal laws of the European Community in relation to the protection of personal data, especially in relation to data stored in its territory. The European regulation contains specific rules on the transfer of personal data between countries, especially in relation to non-European countries.
The Brazilian NGO InternetLab, connected to Fundação Getúlio Vargas, filed a petition as amicus curiae in the United States v. Microsoft Corporation case . It claims that Brazil is one of the largest internet markets. U.S. technology companies such as Facebook, Youtube, Google, and Microsoft have millions of users in Brazil. It also claims that the Brazilian laws related to internet application providers is strictly enforced, despite the American electronic communications law that forbids the delivery of private communications content by electronic communications providers.
The NGO also alleged that the Mutual Legal Assistance Treaty between Brazil and the United States, in the form of Decree No. 3810/2011, is the best legal alternative to solve the conflict between the Brazilian and American laws and jurisdictions, and to apply the laws most appropriate to the case, respecting the sovereignty of each country, the due process of law, and the privacy of the users of internet applications.
Another argument presented by InternetLab is that the Internet Regulatory Framework prevents the disclosure of private communications, guaranteeing the users' right to privacy. Thus, U.S technology companies cannot be forced to directly provide the contents of private communications without a court order from a U.S court. The brief claims that the Brazilian Internet Regulatory Framework offers protection similar to the one purported by the United States Stored Communication Act.
Further, it claims that in the case of the Stored Communications Act (SCA), there is a conflict between two jurisdictions, so the court order has extraterritorial application.
Hence the question posed by InternetLab to the United States Supreme Court, as amicus curiae: "Whether a United States provider of email services must comply with a probable-cause-based warrant issued under 18 U.S.C § 2703 by making disclosure in the United States of electronic communications within that provider's control, even if the provider has decided to store that material abroad".
In this case, the application of two laws on electronic communications puts the internet application provider in a situation of conflict in light of different obligations in each jurisdiction: the United States and Brazil. Hence the need for a solution that grants legal certainty in the application of the law, given the conflict between international laws and jurisdictions, within the realm of the internet.
The conclusion: "This Court should affirm the judgment of the Second Circuit of Appeals and hold that the warrant issued to Microsoft in this matter was an improper extraterritorial application of 18 U.S.C §2703 (b) (1) (A)".
It must be said that the importance of this case lies in the fact that the ruling by the United States Supreme Court may have repercussions in Brazil, specifically on internet application providers that operate herein, even if headquartered abroad.
It is our opinion that Brazil, within the realm of international cooperation between jurisdictions in a case relevant to internet applications, should also participate in the United States x Microsoft soft case as amicus curiae, such as the European Union, Ireland, and New Zealand have done, given the possible repercussion of the ruling of the United States Supreme Court on the interpretation of its law that will impact technology companies that operate globally.
_____________
1 See STF (Brazilian Supreme Court), case Adcon 51, Plaintiff: Federação das Associações das Empresas Brasileiras de Tecnologia da Informação.
2 This is provided in the U.S Stored Communications Act ("SCA"), which forbids electronic communication providers operating under USA jurisdiction to disclose the communications of their respective users, notwithstanding the legal exceptions.
3 Supreme Court of the United States. United States of America v. Microsoft Corporation. On writ of certiorari to the second circuit Court of Appeals. Brief of InternetLab Law and Technology Center as amicus curiae in support of respondent.
4 See: 18 U.S. Code § 2703 - Required disclosure of customer communications or records. A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for on hundred and eighty days or less, only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State Court), issued using State warrant procedures) by a court of competent jurisdiction. A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a wire or electronic communication that has been in a electronic storage in an electronic communications system for more on hundred and eighty days by the means available under subsection (b) of this section".
5 Supreme Court of the United States. United States of America v. Microsoft Corporation. On writ of certiorari to the second circuit Court of Appeals. Brief of InternetLab Law and Technology Center as amicus curiae in support of respondent.
6 Under this aspect of the U.S electronic communications statute, Google was sentenced to pay a fine of USD 8,5 million in a class action filed by users, under the argument that the provider violated the users' right to privacy, before third parties.
_____________
*Ericson M. Scorsim is a lawyer specializing in Communications Law at Meister Scorsim Advocacia.
