The document discusses Brazil's Marco Civil law and its implications for cloud services. It provides background on the development of Marco Civil from 2009-2014 through a civil society process. Key points of Marco Civil include establishing principles of network neutrality, data protection, and non-liability of intermediaries. For cloud services, the law specifies requirements for data storage timeframes, access protocols, and security standards. Overall, Marco Civil aims to balance an open internet with basic privacy protections.

1. Cloud Services
and the
“Marco Civil”
Demi Getschko
NIC.br

2. About Marco Civil - timeline
⚫Marco Civil Brazilian law for the Internet: the main legal
framework dealing with Internet topics in our country;
⚫Deals with freedom of expression, privacy protection, network
neutrality, non-liability of network intermediaries, among other
issues;
⚫Stems from a civil society mobilization:
⚫2009 - effectively formulated,
⚫2010 - passed through online consultation until 2010,
⚫2011 - got into the national congress in 2011 (draft bill),
⚫2014 - enacted into a law,
⚫2016 regulated by a presidential decree, in some specific
aspects.

3. About Marco Civil - Some important events in the process
⚫2007, Rio de Janeiro hosted the second global IGF, which was
discussing sets of principles for Internet policy and governance;
⚫2007 to 2009, huge civil society mobilization over Internet topics,
as they were reacting to some restrictive legislative efforts, aimed
more at punishment provisions than at the protection of rights;
⚫2009, CGI.br announced its “Principles for the Governance and Use
of the Internet”, a set of 10 principles (“The Decalogue”) that were
the basis for the first version of the Marco Civil proposal;
⚫2009, the former Brazilian president Lula, during the International
Free Software Forum, in Porto Alegre, gave a speech supporting the
idea of a civil framework for the Internet in Brazil;

4. About Marco Civil - Some important events in the process
⚫2013, Snowden Revelations powered up Marco Civil progress
inside National Congress;
⚫September 2013, former president Dilma Roussef spoke in the
opening of the UN assembly, with critiques of mass surveillance
and summoning up the world to discuss Internet governance.
Many of the CGI’s Decalogue principles were cited in the speech;
⚫2014, April 23th, Marco Civil was enacted into law during the
opening of NETmundial, held in Brazil. The NETmundial outcome
documents also reflected several principles foreseen in the
CGI.br's Decalogue and in Marco Civil;

5. About Marco Civil
Dilma Roussef enacts Marco Civil into Law - NETmundial meeting

6. CGI.br Principles
1) Freedom, privacy and human rights: The use of the Internet
must be driven by the principles of freedom of expression,
individual privacy and the respect for human rights, recognizing
them as essential to the preservation of a fair and democratic
society.
2)Democratic and collaborative governance: Internet
governance must be exercised in a transparent, multilateral and
democratic manner, with the participation of the various sectors
of society, thereby preserving and encouraging its character as a
collective creation.
3) Universality: Internet access must be universal so that it
becomes a tool for human and social development, thereby
contributing to the formation of an inclusive and
nondiscriminatory society, for the benefit of all.

7. CGI.br Principles
4) Diversity: Cultural diversity must be respected and preserved
and its expression must be stimulated, without the imposition of
beliefs, customs or values.
5) Innovation: Internet governance must promote the continuous
development and widespread dissemination of new technologies
and models for access and use.
6) Network Neutrality: Filtering or traffic privileges must meet
ethical and technical criteria only, excluding any political,
commercial, religious and cultural factors or any other form of
discrimination or preferential treatment.

8. CGI.br Principles
7) Non-liability of network intermediaries: All action taken
against illicit activity on the network must be aimed at those
directly responsible for such activities, and not at the means of
access and transport, always upholding the fundamental
principles of freedom, privacy and the respect for human rights.
8) Functionality, security and stability: The stability, security
and overall functionality of the network must be actively
preserved through the adoption of technical measures that are
consistent with international standards and encourage the
adoption of best practices.

9. CGI.br Principles
9) Standardization and interoperability: The Internet must be
based on open standards that facilitate interoperability and enable
all to participate in its development.
10) Legal and regulatory environments: The legal and
regulatory environments must preserve the dynamics of the
Internet as a space for collaboration.

10. About Marco Civil - Premises for the Internet
What is at stake for cloud services?
⚫The expanding Internet should be maintained as an open platform,
that promotes innovation and reaches the different societal areas,
⚫The Internet has an essentially cross-border nature that puts
difficulties for users, policymakers, legislators and operators to
strictly bind it in too restricted rules,
⚫As the Internet expands, it turns to have millions of distinct
applications which become part of daily life, with several new needs
in technological support to human interaction with/in the network,
⚫Cloud computing is a turning point, one of the innovative ways that
came to bridge some gaps in terms of demand for traffic, real time
remote file managing, decentralized forms of keeping personal
information, remote access to those information among others.

11. About Marco Civil - What Marco Civil primarily does
What is at stake for cloud services?
⚫Marco Civil is after all a set of protections for Internet actors,
establishing consensus that impact all Internet ecosystem;
⚫Marco Civil consolidates a protection regime granting neutrality
within the Internet, preventing access providers to discriminate
network traffic in unreasonable ways;
⚫MCI puts in place basic protections for personal data and
indicates responsibilities for service providers regarding
collection, storage and processing of data, so as to create common
ground for national businesses that depend on the Internet;
⚫The law also deals with other principles like the non-liability of
network intermediaries, so as providers will not be considered
liable for crimes committed by theirs users;

12. About Marco Civil -Main shifts
What is at stake for cloud services?
⚫The main shift presented by Marco Civil that impacts any kind of
platform storing and/or processing personal data is that the law
specifies the time-frame for platforms to keep user data related to
the access to applications (6 months);
⚫Marco Civil also brings new operational guidelines for the storage
systems to observe in their data centers, such as rules for
accessing and documenting access to data, and formats for the
storage and disclosure of data;

13. About Marco Civil -Main shifts
What is at stake for cloud services?
⚫Marco Civil specifies the types of providers that have the
obligation of keeping data, focusing for-profit players with
material conditions for that;
⚫Marco Civil recognizes, as a principle, the Internet global scale,
applies liability of agents according to their activities, and states
that Internet players which have at least part of their activities
taking place inside Brazil should follow Brazilian law (Art. 11);

14. About Marco Civil - Main shifts
What is at stake for cloud services?
⚫Marco Civil seeks to promote open technological standards for
communication, accessibility and interoperability between
applications and databases;
⚫MCI specifies that platforms are obliged to remove contents only if
there is a court order calling for that, otherwise platforms should
not be liable for eventual damage caused by those contents;
⚫The Decree that regulates some of MCI aspects also brings
guidance regarding security standards, establishing rules related
to the adequate oversight of who have access to user data, the
provision of authentication mechanisms, the implementation of
measures for protecting data, e.g. encryption or equivalent tools.

15. Obrigado!
demi@nic.br