Today InternetLab, Brazil’s leading digital rights organization, released their 2017 report on local telecommunications companies, and how they treat their customer's private information. Brazil’s “Quem defende seus dados?” (“Who Defends Your Data?”) seeks to encourage companies to compete for users by showing who will stand up for their customer privacy and data protection. That is why InternetLab, one of the leading independent research centers on Internet policy in Brazil, has evaluated key Brazilian telecommunications companies’ policies to assess their commitment to user privacy when the government comes calling for their users' personal data.

This report is part of a continent-wide initiative by South America’s leading digital rights groups to shine a light on Internet privacy practices in the region, based on EFF's annual Who Has Your Back report. (Last week both Paraguay's TEDIC and Chile’s Derechos Digitales published reports, and digital rights groups in Colombia, Mexico, and Argentina will be releasing similar studies soon.)

InternetLab chose the Internet Service Providers (ISPs) that, according to data released by the Brazilian National Telecommunications Agency in October 2016, each held at least 10% of all Internet accesses in Brazil—either by fixed broadband or mobile data. As such, the “Quem defende seus dados?" report includes an assessment of companies that account for about 90% of the Internet connections in Brazil—NET, Oi and Vivo (broadband) and Claro, Oi, TIM and Vivo (mobile). Together, these companies’ logs hold intimate records of the movements and relationships of almost every citizen of the country.

InternetLab has developed its own methodology to address the social and legal realities in Brazil, focusing on (1) public commitment to compliance with the law; (2) adoption of pro-user practices and policies; and (3) transparency about practices and policies. The report promotes transparency and best practices in the field of privacy and data protection, empowering Internet users by educating them about their consumer choices.

Each company was evaluated using six categories:

• Information about data processing: Does the ISP provide clear and complete information about the collection, use, storage, processing, and protection of users’ data?
• Information about terms of compliance with data requests from the government: Does the ISP commit to disclose account information and connection logs only upon a court order and, in the case of account information, upon application by competent administrative authorities?
• Fights for user privacy in the courts: Has the ISP judicially challenged abusive data requests or legislation that it considers harmful to user privacy?
• Fights for user privacy in public debates: Has the ISP engaged in public debates about laws, bills, and public policies that may affect user privacy? Does it defend projects that aim to advance privacy?
• Publishes transparency reports about data requests: Does the company publish transparency reports that contain information about how many times governments sought user data and how often the company provided user data to governments?
• User notification: Does the company notify the user about data requests by the government?

You can read the full explanation of each category on InternetLab's site.

 InternetLab’s chart ranking the Brazilian telecommunications companies is below.

Since InternetLab’s first report, there are signs of improvement. This year, Vivo was the only company to receive a full star for informing their customers about data protection practices and also for publishing a transparency report. These were the first full stars in these categories. In addition, InternetLab awarded Claro, Oi, and TIM full stars for fighting for their users in court, while last year only TIM earned a full star. TIM also earned a full star for fighting for their customers in public debates. Vivo and TIM’s mobile division vied for first place with three and three-quarters stars.

However, in 2017, no company received a full star for holding out a commitment to disclosing account information and connection logs only upon a court order or, in the case of account information, upon application by competent administrative authorities. Last year, InternetLab awarded two companies full stars in the then-current version of this category. And, once again, no company earned credit for providing their customers with notice of government requests for data.

While there has been definite progress, there remains significant room for improvement.  InternetLab invites the companies to develop privacy policies so users may understand how their personal data is treated, as requested by the Marco Civil da Internet, and how the ISPs deal with information demands from the government. InternetLab also encourages the companies to use the “press rooms” on their websites to list their actions in defense of privacy and data protection in the courts and in public debates. Finally, InternetLab also encourages companies to publish transparency reports and to adopt user notification practices.