In a Public Class Action filed in 2013 by the Public Prosecutor´s Office in Mato Grosso do Sul (MPF-MT), the 1st Federal Court of Campo Grande ordered Oi to pay BRL 1.5 million as compensation for collective moral damages, for sharing clients’ personal data with value-added service providers (SVA) without consent.
According to the MPF-MT, in 2012, MPF-MT received 15 complaints forwarded by the Consumer Protection Agency – PROCON, whereby consumers reported that they hired the fixed broadband service Oi named Velox and soon after started receiving numerous calls from SVA providers requiring confirmation of their personal data, as well as providing bank and credit card information, as a condition for permit the login and password to authenticate and activate the internet connection. In a few cases, consumers received an invoice from the SVA provider without any service been contracted.
This practice was within the context in which Multimedia Communication Service (Serviço de Comunicação Multimedia – SCM) – the Brazilian Telecommunication Agency´s (Anatel) denomination for fixed broadband service – did not include internet access. At that time, Anatel regulation for SCM (Resolution 272/2001) required the combination of two distinct services for effective internet browsing: The SCM for transmission, emission, and reception of data and the SVA for providing data authenticators for connection to the Internet. The latter was exclusive to the so-called Internet Connection Service Providers (ICSP).
Only as of May of 2013, under Resolution 614/2013, it became possible to SCM companies to provide connection/access to the internet, eliminating the need to hire an ICSPs.
In view of this, the central question was to determine Oi’s participation in sharing its customers’ data with PSCIs. To such purpose, the judge ordered Anatel to conduct an inspection procedure against Oi in order to determine the (i) origin of the data sharing, (ii) who was responsible, (iii) the sharing procedure adopted, (iv) the participation of Oi or only third parties.
In the report provided by Anatel, it was evidenced that: (i) Oi maintained commercial partnership with the PSCIs; (ii) the partnership contracts included standard clauses providing for confidentiality, sharing and use of confidential information; (iii) the partnerships contemplated sharing confidential information.
More information was gathered in a meeting between Oi and Anatel technicians responsible for the inspection process. According to the Anatel report, “when questioned about how the exchange of information worked between the Telecom and Service Providers, and how the service is made available to users, the representatives gave a brief presentation “Contracting Provider – Portal Captivo”, available in Annex III, and reported that the only information exchanged is the Name, Individual Taxpayers’ Register, telephone number, and that there is no database exchange and the procedure of making available occurs as follows: The user that requests the Multimedia Communication Service “Velox” receives at home a kit for “self-installation” and when user makes the first access, he/she is directed to a web page asking if he wants a free or paid provider.”
According to the judge, the information gathered at the meeting demonstrates that the data sharing originates from Oi and that the company participated and was responsible for supplying the essential information for the existence and maintenance of the practice described in the complaint.
Based on Article 5º, paragraphs X(1) and XII , of the Federal Constitution, Article 3º of the General Telecommunications Law(3), and on Article 57 of Anatel Resolution 272/2001(4), the judge understood that by sharing personal information of clients, without authorization, as a result of the rendering of its services, Oi offended customers’ intimacy, privacy, and data confidentiality.
Therefore, the judge recognized the occurrence of collective moral damage, as the conduct of Oi characterize a serious affront to collective social values, especially the intimacy, secrecy, and respect of confidentiality of personal information of consumers and also to the confidence in the rules governing the market, with a negative and serious impact on all consumers of its services.
The amount of the condemnation was of BRL 1.5 million, which must be destined to the Fund for the Defense of Diffuse Rights, created by Decree 1,306/1994, pursuant to Article 13 and 20 of Law 7.347/1985.
In addition, Oi was ordered to cease sharing costumers’ personal information with SVA companies, especially by removing the permissive clauses contained in the commercial partnership agreements previously signed and still in force that enables sharing of personal data, under penalty of a daily fine of BRL 50.000,00.
Oi appealed the sentence.
1. The privacy, private life, honor and image of persons are inviolable, and the right to compensation for property or moral damages resulting from their violation is ensured.
2. The secrecy of correspondence and of telegraphic, data and telephone communications is inviolable, except, in the latter case, by court order, in the cases and in the manner prescribed by law for the purposes of criminal investigation or criminal procedural finding of facts.
3. Art. 3º The user of telecommunications services has the right: (…) IX – to the respect of their privacy in the collection documents and in the use of their personal data by the service provider.
4. Art. 57 The provider shall observe the duty of ensuring the inherent confidentiality of telecommunications services and the confidentiality of subscriber data and information, employing all means and technology necessary to ensure these rights.