Data Privacy and Freedom of Information: When Two Laws Impact Society in the Digital World

The Brazilian Personal Data Protection Act, modelled on the European code, is used by the authorities to refuse requests for data made under the Freedom of Information Act.

A post by Cristian Edel Weiss, Fernanda Rodrigues and Mariana Fermino

Tuesday, 28 June 2022

Media, Technology and Society

The Freedom of Information Act has made great strides in promoting public transparency in young democracies and developing countries. Information that was previously withheld by governments is now published on the internet.

It is also undeniable that, to ensure the security of citizens on the World Wide Web, a personal data protection law was needed. However, in Brazil, for example, this debate has become complex.

The federal government has used the personal data protection law as a pretext to prevent the release of public data, representing a step backwards in public transparency. And there is already ample evidence of this malpractice.

What is the Data Protection Act?

When it comes to the Data Protection Act, the impact on society is clear. Essentially, it involves protecting individuals’ sensitive information.

Personal data (e.g. name, address, health information and other details) is constantly exposed due to the use of apps that track location, the types of videos watched, information searched for and communications on various social media platforms. Ultimately, what ensures that privacy is protected and that personal data is not used for commercial purposes?

The privacy laws enacted in various countries serve this purpose, and the GDPR (General Data Protection Regulation) plays a key role in this area.

These regulations came into force on 25 May 2018 in the European Union, and they essentially guarantee that all information collected from individuals will not be used without their consent; they also act against the misuse of data, amongst other measures that reinforce this principle.

Other countries drew inspiration from the GDPR to create their own regulations; Brazil was one of them. The so-called LGPD (Lei Geral de Proteção de Dados) was published on 14 August 2018 (almost three months after the GDPR came into force), and aims to ensure the security of online data, placing this responsibility on all types of organisations that process the data of Brazilian citizens.

What is the Freedom of Information Act?

Although somewhat later than other Latin American and emerging economies, Brazil passed the Freedom of Information Act (Lei de Acesso à Informação) in 2012. The law sparked unprecedented advances in public transparency, opening up new avenues for investigative journalism, fact-checking, data journalism and citizen engagement.

In Brazil, the Freedom of Information Act has enabled journalists and the public to access information from the government and other official sources on topics including the use of public funds, public officials’ salaries and many other important data that could shape public opinion.

Both active public transparency (where the public body itself decides to release data and documents) and passive transparency (where disclosure is triggered by citizens’ requests) have made great strides.

Had the law not existed, journalists would not have been able to publish many high-impact stories, particularly those concerning public expenditure, the exorbitant salaries of politicians and judges, and the impact on health and education.

A series of articles by O Globo, one of Brazil’s leading newspapers, revealed how the Freedom of Information Act can transform journalism and society. In these articles, O Globo’s journalists used the Freedom of Information Act to access data on the Brazilian Air Force’s (FAB) use of aircraft to transport organs for transplantation.

Journalists discovered that the FAB had refused to transport 153 organs for transplant in patients between 2013 and 2015. In its defence, the FAB stated that the aircraft were unavailable. However, according to O Globo, the aircraft were used on the very same days to transport politicians, ministers and officials.

Figure 5: Refusals by the Brazilian Air Force (FAB) prevented the transplantation of 153 organs. On the same days, the Air Force fulfilled 716 requests from politicians, who were allowed to travel free of charge anywhere in Brazil and were given priority (© O Globo, 2016)

As it is a military organisation, there was no open data on flights. The Freedom of Information Act was therefore essential to compel the military to provide data. The articles also highlighted the consequences of these figures.

In at least one case, the FAB refused to transport a human heart that was due to be transplanted into a patient on 21 December 2015. He died two months later. On the same day, an aeroplane was used to transport a politician.

The impact of this series of articles was enormous. One day after the main article was published, President Michel Temer signed a decree requiring the FAB to use an aeroplane to transport organs – meaning this should be the priority.

During the coronavirus pandemic, journalists in Brazil have been using the Freedom of Information Act more than ever to obtain data on patients and deaths.

The law helped G1, a major Brazilian news portal, to reveal that 703 people had died whilst waiting for Intensive Care Units (ICUs) over a 15-month period in the Federal District, where Brazil’s capital is located.

The pandemic led to numerous conflicts between journalists and the government, which for several weeks cited technical problems and refused to disclose the number of infections or deaths. The crisis was so severe that a consortium of major media companies was formed to find an alternative method of data collection.

The Freedom of Information Act also played a key role in revealing, for the first time, the salaries of public sector employees and politicians. Several articles over the past 10 years have exposed illegal conduct by employees earning more than twice the amount permitted by law.

Local authorities are obliged to publish monthly data on the earnings of each employee, including their names and departments.

Side effects: when does the conflict begin?

Since the Freedom of Information Act came into force in Brazil, between 2011 and 2012, more than 1 million requests have already been made by journalists, citizens, researchers and other groups.

After many years of having a significant social impact, however, the Freedom of Information Act now faces a new challenge in Brazil: a conflict with the new Personal Data Protection Act. Federal and local governments have used the Personal Data Protection Act as a pretext to prevent the release of public data required under the Freedom of Information Act. Governments typically argue that ‘sensitive personal data’ is involved, even when no personal data is requested by citizens or journalists.

According to an article published on UOL in May 2022, a study showed that 26.5 per cent of requests made under the Freedom of Information Act were rejected by Jair Bolsonaro’s government on the grounds of the “need for confidentiality of information”.

These rejections took place between January 2019 and December 2021. The figure is twice as high as during Dilma Rousseff’s government (2011–2016).

One of the most recent cases occurred in March 2022, following a meeting between President Jair Bolsonaro and pastors at the official government headquarters in Brasília. The pastors were under investigation by the Federal Police on suspicion of lobbying activities.

According to the police, they were suspected of soliciting bribes in exchange for channelling funds from the Ministry of Education to local authorities. Under the Freedom of Information Act, journalists requested access to information regarding the pastors’ visits to Jair Bolsonaro, but the government invoked provisions of the Data Protection Act to deny the request.

At the same time, the Ministry of Education decided to suspend the publication of detailed data from the School Census, a best practice in public transparency that had been published annually since the 1990s, containing information on the conditions of public and private schools, pupils and teachers across the country.

Now, only summarised open data is available. Researchers and journalists can no longer analyse pupil and teacher data and cross-check it against other public databases for investigative purposes.

Figure 6: Requests made under the Freedom of Information Act that were denied by the Brazilian government, which claimed they ‘breached’ the Personal Data Protection Act (Source: Fiquem Sabendo, 2022)

Once again, the Ministry of Education’s justification is that the old format of publication was in breach of the Personal Data Protection Act, even though the data had already been anonymised (i.e. without any personally identifiable information).

This is another point that still appears unclear. A study published in May 2022, based on information withheld by the federal government in response to requests under the Freedom of Information Act, indicated that 60% of the government’s refusals cited the Personal Data Protection Act as the reason. In 10% of these refused requests, citizens had sought access to anonymised databases.

Conclusion

In the age of big data, a dilemma arises, particularly in young democracies. On the one hand, citizens are vulnerable to personal data leaks and the misuse of private information for commercial or illicit purposes. On the other hand, in countries with high levels of corruption and mistrust of those in power, there is a growing demand for greater public transparency.

However, it is dangerous when authorities exploit this dichotomy and use privacy as an argument to conceal information, as we explained above with regard to Brazil. The challenge is to strike a balance between these forces to safeguard citizens’ privacy without concealing public information relevant to the exercise of citizenship and the fight against corruption.

Presentation: The clash between two data laws and its implications for democracy (2) – pages 1–24

References:

Brazil’s General Data Protection Act | Wilson Center. (n.d.). Www.wilsoncenter.org. Retrieved 13 June 2022, from https://www.wilsoncenter.org/article/brazils-general-data-protection-act

‌Collins, T. (n.d.). EU passes historic law to hold social media sites accountable for illegal content. USA TODAY. https://eu.usatoday.com/story/tech/2022/04/22/european-union-law-meta-facebook-google/7419892001/

Covid-19: 703 people have died whilst waiting for an ICU bed in the Federal District since the start of the pandemic. (n.d.). G1. Retrieved 13 June 2022, from https://g1.globo.com/df/distrito-federal/noticia/2021/06/22/covid-19-703-people-have-died-whilst-waiting-for-ICU-beds-in-the-Federal-District-since-the-start-of-the-pandemic.ghtml

European Commission. (n.d.). The Digital Services Act package | Shaping Europe’s digital future. Digital-Strategy.ec.europa.eu. https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package

‌Freedom of Information – Media law, ethics and regulation – GCSE Journalism (CCEA) Revision. (n.d.). BBC Bitesize. https://www.bbc.co.uk/bitesize/guides/zyt282p/revision/5#:~:text=One%20law%20which%20has%20benefited

GDPR: What Is It and How Might It Affect You? (n.d.). Www.youtube.com. Retrieved 13 June 2022, from https://youtu.be/j6wwBqfSk-o

Laws. (24 August 2017). The Hessian Commissioner for Data Protection and Freedom of Information. https://datenschutz.hessen.de/infothek/gesetze

Bolsonaro government expands use of secrecy to block access to information [08/05/2022]. (n.d.). Noticias.uol.com.br. Retrieved 13 June 2022, from https://noticias.uol.com.br/ultimas-noticias/agencia-estado/2022/05/08/governo-amplia-uso-de-sigilo-para-barrar-acesso-a-informacao.htm?cmpid=copiaecola

Infographic: Where Do Freedom of Information Laws Exist? (n.d.). Statista Infographics. https://www.statista.com/chart/17879/global-freedom-of-information-laws/

‌Mastering data protection in the pharmaceutical industry. (2 October 2019). PMLive. https://www.pmlive.com/pharma_intelligence/Mastering_data_protection_in_the_pharma_industry_1301807

Organisations denied transport and flights by the authorities. (n.d.). Infographics – O Globo. Retrieved 13 June 2022, from https://infograficos.oglobo.globo.com/politica/os-orgaos-com-transporte-recusado-e-os-voos-das-autoridades.html

‌Report analyses the impact of the LGPD on access to public information. (6 May 2022). Fiquem Sabendo. https://fiquemsabendo.com.br/transparencia/relatorio-lgpd/

TEMPO, O. (13 April 2022). Bolsonaro’s meetings with MEC lobbyist pastors are classified | O TEMPO. Www.otempo.com.br. https://www.otempo.com.br/politica/governo/encontros-de-bolsonaro-com-pastores-lobistas-do-mec-sao-colocados-em-sigilo-1.2653510

United Nations Conference on Trade and Development. (2021). Data Protection and Privacy Legislation Worldwide | UNCTAD. Unctad.org. https://unctad.org/page/data-protection-and-privacy-legislation-worldwide

Vélez spent R$75,000 on accommodation and moving to Brasília. (1 April 2019). Fiquem Sabendo. https://fiquemsabendo.com.br/educacao/velez-gastou-75-mil-em-mudanca-para-brasilia/

Why Privacy Matters? (Data Privacy Day) – Analytics Platform – Matomo. (6 April 2017). Analytics Platform – Matomo. https://matomo.org/blog/2014/01/data-privacy-day-january-28th/