In a statement released Wednesday, the Brazilian Parliament reported that members had reached an agreement the previous evening to remove from an Internet regulation bill called Marco Civil a recently added requirement for companies to keep within the country any data pertaining to Brazilian users.
Lawmakers tacked the provision onto the proposed Internet governance law shortly after former government contractor Edward Snowden went public in June with a cache of leaked documents that detailed the National Security Agency's surveillance activities. The leaks included alleged evidence reported in October that U.S. government officials had eavesdropped on Brazilian President Dilma Rousseff's private communications.
Parliament members argued that the data localization provision, which was backed by Rousseff, was necessary to give Brazilian courts better access to documents stored in foreign countries by multinational service providers. Currently, the only means for obtaining data from the U.S. for use in court proceedings is through a lengthy request process governed by the Mutual Legal Assistance Treaty, lawmakers said.
But multinational companies have argued that the storage restriction would require them to undertake the costly task of locating or building data centers to store the information and open them up to increased compliance risks.
Richard Salgado, Google's law enforcement and information security matters director, reiterated this position during a Senate subcommittee hearing in November, testifying that such proposals had the potential to transform the free and open Internet that currently exists into a regional "splinternet" at the expense of the U.S. economy.
“As we speak, the Brazilian Congress, for example, is considering legislation that would require data relating to the Brazilian operations of both domestic and international companies — as well as Brazilian citizens — to be stored in Brazil ,” Salgado said during the hearing. “Companies like Google that do not comply with such a requirement could be barred from doing business in one of the world's most significant markets or be obligated to pay hundreds of millions of dollars in fines.”
The Washington, D.C.-based Information Technology Industry Council, which represents U.S. technology companies, said in a statement Wednesday that it was “very pleased” that the parliament had elected to remove the data localization requirements from the legislative proposal.
However, the group noted that while the amendment addresses some corporate concerns, there were still potential problems with other parts of the bill, which was floated more than two years ago but only gained steam after Brazil's president moved to prioritize the measure following the Snowden disclosures.
For example, the bill — which marks the country's first attempt at regulating the Internet — still contains a provision that would require companies that collect data from Brazilian citizens to abide by the country's regulations for producing data required by a judicial order.
The net neutrality portion of the bill, which would prohibit companies from charging differential pricing for various levels of Internet usage and speeds, also remains a point of contention.
As part of the agreement reached Tuesday, the rapporteur of the legislation committed to making adjustments to the wording of the provision to clarify that the president's power to regulate exceptions to the net neutrality requirement for emergency services or technical requirements was limited to the confines of the country's constitution.
“To make it even clearer that the decree will cover only exceptions to neutrality, we made the change,” rapporteur Alessandro Molon said.
Lawmakers will continue their debate on the legislation until Tuesday, when the discussion period will end, and they can proceed with a vote on the proposal.
--Editing by Christine Chun.