Smith International Legal Consultants, P.A.

According to a report in today's Financial Times, European companies are increasingly shying away from US cloud service providers because of concerns over the reach of the Patriot Act. This interesting piece of news got me thinking about any connection to Brazil and cloud service providers in general. Would similar issues arise in relation to Brazil?

For those of you unfamiliar with some of the terms in the first paragraph, the "cloud" refers to the storage of electronic data on third-party servers. An easy example is an email account from Yahoo! or Gmail. The email does not actually reside in your computer but rather a server in another location; the user merely accesses it through the internet. Recently, this access has expanded and become cheaper, allowing companies to store massive amounts of electronic information on third-party servers. While this may cut costs, it has caused some to worry about the ability of governments to access this information, which leads us to the Patriot Act.

The Patriot Act was passed by the US Congress in response to the attacks on September 11. It gives broader surveillance powers to law enforcement agencies, and it removes prior barriers to forcing companies that hold electronic information from disclosing it. The reach of the Patriot Act is quite broad, and in the words of the managing director of Microsoft UK, neither Microsoft or any other company controlled by a US company can resist the US government's request to hand over data, even if that data is collected and stored on a server in Europe.

So what does this mean for Brazil? The same statements by Microsoft UK would apply to Brazilian companies. Brazilians are heavy users of social networks like Facebook and Orkut (an earlier social network built by Google). Information obtained through both of these services would likely be available to the US government through Patriot Act. The same would be true for Microsoft, Dropbox, and other US companies.

Would there be potential for Brazilian companies to exploit this insecurity felt by local companies? Perhaps. From a business point of view, Brazil's startup community is increasingly growing and becoming more sophisticated. Reports from Brazilian news magazines and journals show higher numbers of investors and entrepreneurs. These individuals could look to build or license a more private form of cloud storage.

On the legal side, investors and companies would have to consider a number of key elements:

• Control. One of the key ways to apply the Patriot Act is through the control exercised by a US company. Would foreign investment equal control and trigger Patriot Act surveillance? This would be important and depend on the investment.
• Local Law. Brazil has a number of data protection laws, some of which provide powerful remedies for consumers under the Consumer Protection Code. These would be important to consider for any Brazilian company or US investor.
• Local Law Enforcement. On the law enforcement front, it appears the Brazilian government has been very active. Another Financial Times article cited Brazil as the second-most active country requesting Google provide information on its users.

Share this post