In the spirit of the French New Year's Eve celebration, réveillon, it is time to wake up and revive the subject of privacy and protection of personal data in Brazil. There are three topics that promise to warm up the Brazilian debate in 2018.

1. Profiling: The tension of boosting content comes to the Brazilian electoral sphere

Our personal data is often collected and shared to "improve our experience." At least, that is what is explained, in most cases, in the terms of use and privacy policies of internet providers. These “improvements” are based on the monitoring of our behavior online and offline and in databases about our tastes and preferences, which personalize products and services for us, as well as content that is shown to us in the platforms. This is the well-known practice called profiling.

Examples of the use of profiling range from the display of an advertisement, the granting of a loan, the setting of an interest rate, the stipulation of the prize of an insurance contract, and so on. This is the reason personal data protection has been seen as a proxy for our own capacity for self-determination. The existence of a minimum sphere of control over our data, associated to the establishment of fair practices in relation to the processing of this information, marks our own ability to avoid being manipulated. This is exactly the tension that is in the heart of the debate about the content boosting regarding electoral and political issues on the Internet.

With the use of the internet, it is possible to “micro target” a political message according to the individual features of the voter. Instead of segmenting the message into large groups (e.g., socioeconomic status, ethnicity, gender, etc.) — something that has been a focus in the mass media — the approach is refined, almost on a one-to-one scale, to the psyche of each audience point.

Given that, what becomes exponential is the possibility of creating different narratives on the same agenda, and that is seductive to different and even conflicting electoral niches. For example, something that called attention during Donald Trump's U.S. presidential campaign would have been his capacity to align messages with each consumer's taste — to the point of making his government plan totally unstable. A candidate can assume a thousand and one faces, projecting themselves in an ambiguous way in each piece of boosted content.

Another aspect is that persuasion is much more accurate. There is an exact resonance between the content of the message and the personality of its target, and, it is often granularly based on sensitive details about the target. This personalization becomes an extremely powerful canvasser, with a significant capacity of interference in the electoral process.

Finally, the boosting of electoral and political content, which became possible after the 2017 mini electoral reform in Brazil, is a new chapter to analyze and discuss the limits of the profiling practice and, more broadly, of internet business models themselves. On one side, the question is in which ways does the dynamics of data mining and behavioral content impact the autonomy of the user-voter to freely get informed and vote? On the other side, can these dynamics, traditionally used for advertising consumer goods, generate (democratic) gains if it is transposed to promote the political debate?

From the legal point of view, an initial response to such queries can be found in Law No. 12.965 / 2014 (Marco Civil da Internet: Brazil’s Internet Bill of Rights) when providing that "Internet access is essential to the exercise of citizenship" and that the "discipline of its use" has as principles "protection of privacy" and "protection of personal data". Those guidelines should drive and constrain the very "freedom of business models promoted on the Internet" (Article 3, subsections II, III and VIII; and Article 7, caput).

For all these reasons, one may consider innocent the initiatives of “tracking” what, for how much, by whom and to whom a certain electoral content has been boosted and personalized. They are considered insufficient because they do not empower the reader-voter with significant control over his/her data and, even less, over the behavioral profile gathered about him/her. And, ultimately, it does not tackle the question of citizen autonomy in getting informed and voting, even if that means simply not being targeted by boosting electoral and political content. 

2. "Data-fication" of the public sector: interface with the principles of administrative law and regulation at municipal level

With the possibility for everyday objects to become sensors capable of recording citizens’ movements and habits, ever more communication and information technologies gain prominence in the public sector. These records can be converted into useful information for guiding policy and optimizing public services. And, mainly, they can help automate part of the activities of public management.

Urban mobility, education, health and public safety are some of the areas in which this dynamic is more noticeable and intense. In education what is being discussed is, for example, the personalization of teaching according to the performance of each student and ranking teachers as a new evaluation method.

Computer programs, through supervised learning algorithms or unsupervised (machine learning), would be responsible for analyzing the data related to this info sphere and making a decision. It is no news that the delegation of these decisions to technology can reinforce biases and trigger a vicious cycle.

And, in this sense, there is an agenda to be developed, imbued with the constitutional principles of the administrative law, in relation to the protection of personal data in the public sector through algorithm governance. Somethings to reflect upon would be, for example: a) In what ways does the principle of publicity of administrative acts determine the adoption of active transparency measures on data mining, especially when submitting the citizen to automated decision making? b) What are the limits imposed by the principle of morality to the management of citizens' data by the public administration, considering that they are not only an asset for the formulation of policies, but also an economic one that can generate revenue and even serve as a counterpart for the decentralization of public activity?

Some of these reflections are beginning to gain momentum at the municipal level.

In New York, the initial proposal of a law project aimed to make available the source code of the algorithms used by government agencies and to allow citizens to test them by inserting random data to see the result returned by the algorithm. However, the approved text was quite shy of the initial suggestion since it only established a group of experts to investigate the impact of these algorithms on New Yorkers' lives, especially whether they promote discriminatory practices.

In São Paulo and in Campinas, as a result of the Campaign Your City, your Data in Brazil, municipal bills are being discussed with the following main points:

• The duty of public sector to be actively transparent in the management of citizen data; e.g., mandatory adoption of open source software for mining its data, and algorithm audits that subject citizens to automated decision-making.
• The prohibition of personal data being traded as a consideration in the decentralization of public activity to private companies and, at the same time, ensuring public entities prioritize the adoption of privacy-enhancing technologies.
• The creation of a municipal council so that society itself can be effectively heard and influence the formulation of public policies based on personal data.

As a general balance, there is a fertile ground to be covered that approximates the field of personal data protection and administrative law. This interface seems to gain traction when it is discussed at the local level as part of a larger reflection on what kind of smart cities people want.

3. The “continuous waiting” for a Comprehensive Personal Data Protection Law

In 2017, in spite of the realization of public hearings and of an international seminar to subsidize the work of the Special Commission of the Chamber of Deputies on Privacy Bills (Bill 4060/2012 and Bill 5276 ), as well as the new draft of Bill 330/2013 at the Senate, it was expected that the agenda of a comprehensive personal data protection law would advance further in the National Congress. 

During the VIII Seminar of Protection to Privacy and Personal Data, the Rapporteur of the Special Commission on Privacy of the Chamber of Deputies himself, Deputy Orlando Silva (PCdoB / SP), confessed that the denouncement against the president of the republic and the political reform took over the political debate. Because of this, the long awaited report of the Special Commission was postponed to this year. 

If the understanding on the matter was already complex, what will be said now, in the middle of the election year and with the welfare reform heading the political agenda in the first half of the year? And at a time of intense economic-fiscal crisis, we cannot lose sight of how difficult the debate has been on the creation of a data protection authority, which would generate more expenses and would not align with austerity measures that should be taken.

This political and economic situation is a proverbial bucket of cold water on the prospect that Brazil could finally have a comprehensive personal data protection in 2018, never mind one with an institutional arrangement – data protection authority – capable of bringing legal certainty in the enforcement of these rules if they ever come to exist.

On the other hand, this is a propitious year for the whole Brazilian society to demand and cover political commitments and government programs that are related to the socioeconomic development of the country. A comprehensive personal data protection law and the creation of a trustworthy authority as a watchdog of data protection rules can and should be capitalized on politically. Perhaps, thus, we can turn over the "key" of Brazil's regulatory backwardness in this agenda.

A version of this article was published in Portuguese at the Legal Portal JOTA.

photo credit: Brazil 2014 via photopin (license)