DATELINE BRASILIA -- Brazil’s Congress has delayed a vote yet again this week on a bill that could have some decidedly negative ramifications for the Internet and the global digital economy. In the months following the NSA surveillance revelations, Brazil’s Marco Civil da Internet, originally a type of constitution for Internet users, has been peppered with provisions that could cripple the growth of the digital economy in Brazil and beyond.
Brazil has grown into a hyperconnected digital nation with the fourth-highest Internet usage in the world with 86 million users, e-commerce estimated to be worth $12 billion annually, and more mobile telephone subscriptions than the 200 million people in Brazil.
Yet provisions in this new and troubling legislation threaten to undermine much of the sweeping progress Brazil has made to plug into the digital economy at home and abroad.
One of the most concerning items contained in the bill is a provision that would give the president decree power to require in-country data storage. If approved, the president would be able to impose this requirement at any time. Given the political firestorm swirling around the Snowden revelations and the tough messaging from President Rousseff, it’s a safe bet to assume she would impose this in-country data-storage requirement in a heartbeat.
Not only are mandates for in-country data storage contrary to the global and decentralized nature of the Internet, they also do not provide added privacy or security. In fact, they would leave Brazil even more vulnerable to security risks. Data security is not a question of server location, but rather depends upon the mechanisms and controls in place to safeguard the data. A data localization mandate would essentially cut Brazil off from the world’s most cutting edge technology and IT solutions and that certainly would not lead to stronger security solutions.
Local data storage mandates could embolden other countries to emulate Brazil and apply these policies reciprocally. This would take us toward a Balkanized Internet whereby country after country walls off their digital ecosystems. Ultimately, this would harm Brazilian industry, from ICT services to manufacturing to banking to tourism, by jeopardizing the ability of these sectors to expand their export potential.
In addition, the bill includes restrictive privacy provisions that will inevitably lead to increased and unnecessary compliance burdens for companies. Overly broad jurisdiction provisions could have significant ramifications on investment and the competitiveness of the Brazilian economy by discouraging companies from establishing a local presence and hiring local employees. Provisions that require companies to disclose their security measures would introduce risks that jeopardize, not increase, security. Informing users about the practices or measures implemented will provide cyber criminals precisely the information they need to target and defeat security controls.
Brazil’s concerns should not come at the cost of innovation and the growth of the digital economy. These issues are best addressed through increased bilateral and multilateral dialogues and investments in the necessary infrastructure that will foster competitiveness and productivity.
Walled gardens are nice botanical solutions, but they do not serve as a useful metaphor for constructing a digital ecosystem that can thrive and grow in our interconnected global economy. Brazil is a vibrant and important economy to the U.S. tech sector. We look forward to continuing to work with the Brazilian government to advance policies that can spur growth of the digital economy here to the benefit of Brazilian citizens and businesses and the world.