Alerts
App providers may need to review internal procedures following STF decision
We inform you that the Federal Supreme Court’s (“STF”) ruling on the constitutionality of Article 19 of the Brazilian Civil Rights Framework for the Internet (“MCI” — Law No. 12,965/2014) was concluded on June 26. A thesis of general repercussion was established by the Supreme Court of Brazil based on the debates held. There were significant changes to the civil liability of application providers, which may require operational adjustments to platforms, applications, and the structure of companies operating in Brazil.
Below, our corporate, civil litigation, and technology teams provide the main information on the subject.
1. What is a thesis of general repercussion, and why is it important?
It is one of the few exceptions in Brazil in which a court ruling becomes binding. It is a legal thesis established by the STF based on its interpretation of a constitutional matter. Once defined, it must be applied uniformly in all similar pending cases in the judiciary and is binding on other courts and judges.
2. What was the STF’s decision?
By a majority vote of eight to three, the STF ruled that Article 19 of the MCI was partially unconstitutional.
According to the justifications presented by the ministers who voted in favor of unconstitutionality, “there is a state of partial omission arising from the fact that the general rule of Article 19 does not provide sufficient protection for constitutional legal rights of high relevance.”
3. Before the Ruling, what was the rule of civil liability for application providers?
General Rule: duty to act only arose after a court order.
According to Article 19, internet application providers (e.g., social networks) can only be held civilly liable for damages arising from content generated by third parties if the following conditions are met: (i) a court order is issued to remove the content; (ii) the order clearly and individually identifies the content to be removed; and (iii) the company does not take the necessary measures to make the content unavailable.
Note that this provision is not equivalent to the “safe harbor” of the US DMCA since the MCI expressly excludes copyright from its scope. Currently, Brazil has no legislation equivalent to the DMCA. Brazilian case law holds that liability for copyright infringement arises from failing to remove content after receiving a notification.
Exception: duty to act arises after a mere extrajudicial notification.
Article 21 of the MCI was frequently cited in the Supreme Court Justices votes, so it is important to understand its wording. This article is an exception to the rule of Article 19 of the MCI. It establishes that, in cases involving the unauthorized disclosure of images, videos, or other materials containing scenes of nudity or of a private sexual nature that violate individuals’ privacy, the application provider will be secondarily liable if it does not act diligently to make the content unavailable after receiving extrajudicial notification, within the technical limits of its service.
Additionally, Article 21’s sole paragraph clarifies that such a notification must contain the following under penalty of nullity: (i) elements that allow for the specific identification of the infringing material and (ii) verification of the request’s legitimacy.
4. After the Ruling, what is the responsibility of application providers after the judgment?
General rule: duty to act after a mere extrajudicial notification that meets the criteria of Article 21 of the MCI.
There are two exceptions to this rule:
Exception 1: There is a duty to act regardless of extrajudicial notification or judicial decision in specific cases, such as advertisements or paid promotion of content, and when artificial illicit distribution networks using robots are detected.
Exception 2: application providers have a duty to act only with a court order in cases of crimes against honor and for neutral providers that do not interfere with content, such as email services, applications for closed meetings, and instant messaging services (e.g., WhatsApp).
In the case of systemic moderation failure, there is a duty to act regardless of notification in specific situations (with an exhaustive list).
5. What thesis is applied to the general rule?
Application providers will be held civilly liable under Article 21 of the MCI when they fail to remove illegal or criminal content after receiving an extrajudicial notification.
Therefore, a court order is no longer necessary for companies to be required to remove illegal or criminal content from their platforms.
6. What is exception 1, in which liability arises from the presumption of illegality?
Civil liability of content providers arises in two scenarios from the presence of the content itself, regardless of prior notification or court decision. These are: (a) advertisements or paid promotion of content, since the platform approves the advertising in these cases; and (b) when artificial distribution networks using robots are detected. The logic is that there is a presumption that the platform was aware of the illegality in these cases. This liability can only be waived if the application provider proves that it acted reasonably and diligently to remove the content in a timely manner.
7. What is exception 2 In which exception does Article 19 of the MCI still apply?
In cases of crimes against honor, such as slander, defamation, and libel, the requirements of Article 19 of the MCI remain applicable. In other words, civil liability arises from noncompliance with a court order. However, this does not prevent content from being removed upon extrajudicial notification.
The focus here is to protect freedom of expression by avoiding censorship and the removal of content conveying criticism, even if it is uncomfortable. However, if the judiciary understands that a particular case is a crime against honor and orders the removal of content, providers must remove publications with identical content based on simple notification, without the need for new court decisions.
Furthermore, Article 19 of the MCI continues to apply to interpersonal communications protected by constitutional confidentiality in neutral providers that do not interfere with content. Examples include email services, applications for closed meetings, and instant messaging services, such as WhatsApp.
8. What happens in the event of a systemic failure in content moderation?
The serious crimes indicated in this exhaustive list are:
- anti-democratic conduct and acts;
- Crimes of terrorism or preparatory acts of terrorism;
- Crimes of inducing, instigating, or assisting suicide or self-mutilation;
- Incitement to discrimination based on race, color, ethnicity, religion, national origin, sexuality, or gender identity (i.e., homophobic and transphobic conduct);
Crimes committed against women on the basis of their gender, including content that propagates hatred or aversion to women.
Sexual crimes against vulnerable persons, child pornography, and serious crimes against children and adolescents;
- Human trafficking.
Finally, the thesis carefully states that the user may request the reinstatement of unavailable content through legal channels if they can prove its legality. In this case, the platform will not be responsible for compensation.
9. What happens in cases of successive replication of offensive content?
If offensive content has already been deemed unlawful by a court, platforms must automatically remove all identical publications upon judicial or extrajudicial notification, without the need for a new court decision.
10. Is there a presumption of liability ?
No. In all these cases, liability is subjective; that is, it requires an analysis of the platform’s fault or intent.
11. What additional duties did the STF establish?
In addition to the new liability system, the STF determined that providers must:
- Create and implement a self-regulation mechanism that includes a notification system, due process, and annual transparency reports regarding extrajudicial notifications, advertisements, and boosts.
- Provide specific customer service channels that also serve non-users.
12. Do application providers need to establish headquarters and have a representative in Brazil?
The thesis states that app providers must establish and maintain headquarters and a legal representative in Brazil. The representative’s identification and contact information must be easily accessible.
This representative must be a legal entity with headquarters in Brazil and have full power to:
(a) respond to administrative and judicial authorities;
(b) provide the competent authorities with information regarding the provider’s operations;
(c) provide the competent authorities with information regarding the rules and procedures used for content moderation and complaint management by internal systems;
(d) provide the competent authorities with transparency, monitoring, and systemic risk management reports;
(e) provide the competent authorities with the rules for user profiling (where applicable) and advertising and paid content promotion;
(c) Complying with court orders;
(d) Responding to and complying with any penalties, fines, and financial assessments incurred by the represented party, especially for noncompliance with legal and judicial obligations.
13. Before the Ruling was there a legal requirement for application providers to establish headquarters or representation in Brazil?
No, except in a few situations where such a requirement arose from the company’s corporate structure. We evaluated the oral votes of all the Justices and found that this point was debated very superficially. Only three of the eleven justices mentioned it explicitly, and they did not provide a clear rationale for the requirement.
The thesis states that maintaining headquarters and a legal representative in Brazil are two mandatory requirements rather than alternative requirements. This position would allow foreign companies to comply with the requirement without establishing subsidiaries in Brazil.
This issue is highly controversial and delicate, and we are carefully assessing how clients should position themselves.
This determination clearly acknowledges the problems the Brazilian justice system has encountered in recent years with foreign platforms operating in Brazil without a legal representative in the country.
14. When does the general repercussion thesis become applicable?
The decision has prospective effects, respecting decisions that have already become final.
15. What are the next steps:
Despite establishing a thesis with broad implications, the STF emphasized the need for the National Congress to take action and draft specific legislation to address the identified gaps.
In the meantime, we recommend that companies classified as “application providers” carefully consider how they will position themselves in light of this new legal guidance in Brazil.
We remain at your disposal for any clarification necessary.