When data protection eclipses national security: Brazil’s Supreme Court leans towards unconstitutionality of ministerial dossier on antifascists

In June 2020, the headline “classified governmental action aims at antifascist professors and police officers” was published by a Brazilian newspaper of national circulation. According to the outlet, the Ministry of Justice had secretly produced and circulated among public agencies a dossier containing names, photographs and social media addresses of 579 public safety governmental employees who participated in antifascism movements, and 3 university professors, all of whom are critical of President Jair Bolsonaro’s administration. This was followed by Action Against a Violation of a Constitutional Fundamental Right No. 722, filed by the Sustainability Network (“REDE”) political party before the Supreme Court.

In the provisional measures’ judgment rendered on 20 August 2020, the Court granted REDE’s request for the immediate suspension of the production and dissemination of intelligence reports related to the said citizens. Justice Cármen Lúcia considered the activity to infringe upon the constitutional rights to freedom of expression, union, association, the inviolability of intimacy, private life, and honour.

The leading opinion disagreed with the Ministry’s counterarguments that the intelligence report was indispensable for governmental decision-making in relation to national security. Its main findings were that the State’s activity unnecessarily interfered with freedom of expression and fell outside the institutional limits prescribed by law, since the collection of information for the purposes of monitoring citizens with a political position contrary to that of the present government constituted a misuse of the public apparatus.

While the importance of the rights to freedom of expression, union and association is self-evident in the main vote, another right was noted in Justices Barroso’s and Weber’s opinions: The fundamental right to personal data protection. Due to its recent recognition as a stand-alone fundamental human right in the Brazilian legal order – under the auspices of a General Data Protection Law (LGPD) that partially entered into force not long ago – the Supreme Court faces new balancing challenges. This case is a perfect example of that challenge. In the words of Justice Barroso, “we are here dealing with this duality: intelligence and data protection.”

Similar to the EU’s General Data Protection Regulation’s Article 23, 1(a),  Brazilian LGDP’s Article 4, III(c) also permits data processing activities for the exclusive purpose of national security. However, this does not imply that any processing activity, such as the production of intelligence reports, seemingly carried out under the auspices of national security, is in accordance with the right to data protection. As recently noted by the Court of Justice of the European Union in Schrems II (paras. 180-184), even when national security is at stake, any interference with the right to data protection must meet the proportionality standard. To that end, any limitation of the right must be clearly defined, together with governance rules and minimum legal safeguards.

Transposing this rationale to the Brazilian landscape, the legitimacy of national security as an objective is enshrined in Law No. 9.883/99, which instituted the Brazilian System of Intelligence (“SISBIN”). Nevertheless, it appears that Brazil’s highest court is moving towards a position that rejects the idea of an absolute legitimacy, in favour of a relativism conditioned to either judicial or parliamentary review. In fact, Justice Weber’s opinion outlined this view by asserting that Article 3 of Law No. 9.883 provides that intelligence activity is only legitimate if compliant with individual rights and guarantees as well as the guiding ethical principles of the State’s intelligence activity.

This approach follows the precedent recently established in the Direct Action for the Declaration of Unconstitutionality 6.259. In short, the Court upheld that any data exchange between SISBIN’s agencies must be properly justified and the measure must be proven to strictly abide by the public interest of protecting the Nation’s institutions and interests, rather than circumventing constitutional limits to serve the private purposes of government officials or public agents.

That tension between data protection and national security exists is a globally-accepted truth since the world first learned Edward Snowden’s name. Now, it is up to nations to effectively balance these interests, and Brazil’s executive branch, as an unexpected younger brother, is being taught its first steps by the judiciary.