Privacy and data protection in Brazilian smart cities
7 de May de 2018
The transformation between models of Brazilian public administration over the years shows, initially, how the public administration is a reflection of an economically dominant model and how public policies are thus oriented.
The implantation of a bureaucratic model of public administration in the 1930s was marked by a growth of the State structure, administrative organization, and investment in public policies. The year of 1988 would mean the consolidation in legal terms of a model of public administration based on social welfare, since the Constitution of 1988 brings within its scope a wide range of individual rights, mainly, social and diffuse rights that require the action of the State, as an actor guaranteeing rights.
In the same period, the international context was inserted in a new world order, marked by globalization, internationalization of capital and great neoliberal influence, which engendered an entrepreneurship model for the State, enforced by the discourse of a “failure of the state of social welfare” from the Washington Consensus and the implantation of neoliberal models in Latin America.
State-company relations: social privatization
Within the process of neoliberalization of the economy, some actors gained relevance and changed its roles in this scenario – the State, the City and the Market. The State was essentially the provider of social benefits; the City was considered a place of exchange and living; finally, the Market adapted to a rigid and stable logic allowed by this economic model. The neoliberalization of the economy engenders characteristics much more unstable to these actors. It is interesting, in this sense, the role played by cities, or the “process of making the city, which is both the product and condition of the social processes of transformation in progress, in the most recent phase of capitalist development,” as David Harvey in A capitalist production of space (2005). For the author, these changes meant the transition from an “administrativism”model to an “entrepreneurship” model.
In Brazil, as early as 1989, with the creation of the Ministry of Administration and State Reform, there would be a transition from a bureaucratic administration to a managerial administration, justified by an increase in the State, which would not be able to fulfill promises of a social welfare State, with the implementation and control of public policies.
One of the first measures was Publicity (Bresser Plan), which meant opening up and institutionalizing the third sector and other partnerships, often (problematically) replacing the State, such as supporting entities and social organizations. This plan has resulted in openness to the third sector (first is the State, second is the Market) and has gradually been consolidated as a way of participation, often reduced to charitable services and replacement of the State.
From these and other justifications for the (re)configuration of the administrative model, Fernando Henrique Cardoso continues with Bresser as his Minister and initiates the privatization, which had the purpose of privatizing state companies – these two movements (publicity and privatization) would virtually annul the achievements of the 1988 Constitution. It is interesting to note that the National Privatization Council is one of the few in the country that does not have a representative of civil society.
The emergence of Public Private Partnerships (PPP) accompanied the transition framework for the managerial administration model, but in practice it is still an embryo of the Consensual Administration model based on the discourse that it would be necessary to reduce the discretionary aspect of the administration, so that one walks increasingly towards equitable treatment between the public administration and the private sector, an increase in internal and external control and control models.
Models of administrative management in urban planning
Taking into account the transformations in the administrative model demonstrated, it is necessary to think, then, about the materialization of these models in the cities, as urban structure. We start from these criticisms to understand how these models reflected in the city, especially considering the technological importance for the materialization of the public policies in the territory. Of course, in the peripheral countries the economic models predominantly implanted in developed countries do not reach their full extent in the countries of the global South, something like the implementation of models and projects in places without sufficient economic, social, technological and human capital structure. The mishaps brought by globalization corroborate not only economically, but also spatially, the alteration of the models of cities produced from the logic of financialization enhanced by the neoliberal model.
Spatially, the model of cities in the peripheral cities imploded from the 1930s with the beginning of industrialization, coffee crisis and the consequent urban exodus. Brazilian cities, as well as generically the cities of the South, are already marked by territorial exclusion, even in planned cities, the periphery has grown much faster than the central areas – which implies that access to goods and services, since the beginning of the formation of cities, it is difficult for most of the population that does not inhabit central areas.
This city model culminates recently in a neoliberal version, which is based on the proposal of sustainable, intelligent and connected cities, the so-called smart cities, which were conceived from a connection between the spatial model and the people who local, with the proposal of using the technologies optimize the space.
Within this model of smart cities, we have the city of São Paulo and the attempts of Mayor João Dória, as an example, through his Privatization Program, to implement “free” wi-fi in the city. Many capitals have already given access to the internet to those who transit through an application form or website of local public administration. What we are trying to verify here are the particularities of the case of São Paulo and how this goesagainst national and international normative standards.
João Dória’s management and the smart city program of São Paulo
João Agripino da Costa Dória Júnior, former mayor of one of the largest capitals in the world, is also a former host (2010 – 2011) of the Brazilian version of the American series The Apprentice, and has an estimated equity of R$ 180 million, according to data provided to the Superior Electoral Tribunal.
Dória comes from a party of traditionally liberalizing proposals on economic issues, the Party of Brazilian Social Democracy – PSDB. It was from this platform that João Dória was elected in the first electoral round, a fact that had not occurred for more than two decades in the city. Among the promises of the campaign were the privatization of several sectors of the municipal government, “the creation of a digital city that was guided […] by the logic of generating efficiency and expansion of public services, without the concern of combining with measures that would guarantee privacy and data protection“, the increase in public-private partnerships, based on the promise of the largest privatization program in the city of São Paulo, the digitalization of services and the increase of speed limits for cars in the city.
Understanding this context is essential to analyze the nature of the Municipal Privatization Plan (PMD), embodied in Bill No. 01-00367 of 2017, forwarded by the Executive Power to the City Council of São Paulo and how this project aligns itself in the administrative management model and smart cities.
The privatization of the services offered in parks, squares and planetariums, according to what is studied, is precisely what would allow the concessionaires of the City Hall to offer “free” wi-fi networks by registering users and terms of use that may involve, among others things, monitoring navigation and preferences for products and services.
Another possibility is that the companies that assume these concessions sell information about the users of their networks in order to make viable economic returns to the necessary infrastructure investments for the installation of wi-fi. This was because the original bill provided for the unnecessary provision of personal data, but that device was vetoed. According to Bruno Bioni, “the private initiative would offer all the infrastructure of connectivity and in return would receive the navigation data of the users of ‘Free Wi-Fi’ from the registry of the sites that they accessed.” The author also analyzes that the online behavior of the São Paulo users, once connected to the Public Wi-Fi, would be the consideration of the public-private partnership by the connection infrastructure providers.
In July 2017, the City Hall of São Paulo published a public notice to gather preliminary subsidies for the structuring of its Wi-Fi project, aiming at the implementation, operation and maintenance of free Wi-Fi internet access points, in public places in the city of São Paulo. The WiFi Project is an expansion of the current Wi-Fi Program andamis to reach almost two thousand locations, divided between mandatory (about 500) and optional (about 1,500), which will be the object of a future bidding of locations.
It is interesting to note that this announcement provides that companies will not be allowed to carry out traffic shaping or other mechanisms that violate the net neutrality, the privacy of the users or the freedom of the use of the Internet. The guarantees, rights and duties of the use of the Internet in Brazil, according to Brazilian law, notably Law 12.965/2014, the Brazilian Internet Bill of Rights, shall be guaranteed by the eventual private contractor. According to the document, “the confidential nature of user information will be guaranteed and can not be shared in any way, including for commercial, advertising or statistical use.”
However, important remarks are made regarding the information of users that may be passed on to third parties in order to limit the transfer of information, leaving it, even if valid, in line with constitutional rules, especially respect for privacy and privacy.
That is, even if the public notice expressly refers to the Brazilian Bill of Internet Rights and its parameters of maintenance of network neutrality, rights, guarantees and duties of users, opens the possibility of passing on to third parties information from users, “observing the constitutional and legal principles relating to the privacy and confidentiality of personal data”. Brazil, however, does not have a legislative instrument and, therefore, a more comprehensive policy focused on the privacy and protection of personal data in relation to Internet applications and the shared use of new technologies, although through permission holders or concessionaires of public services. Even more worrisome is the commercialization of the privacy concept in the smart cities model adopted, as users would have no choice as to how to use their browsing data when connected through public Wi-Fi.
In the event of a deepening of the smart cities model, especially if we take into account the developments in the Internet of Things (IoT), as Bioni says, “privacy and protection of personal data are strategic and inseparable issues of a national IoT plan. And in this context, Brazil needs to do homework. There must be a general law.”
Internet access, privacy and protection of personal data in Brazil
In this context of various uncertainties, there is Bill N. 5,276, sent to National Congress by the Presidency of the Republic. Within the scope of the Executive Branch, the then Draft Law on Data Protection followed the consultation model on which the Civil Code was based. The text of the Ministry of Justice has been made available online and open to comments from any users. In this way, as in the process of elaborating the Brazilian Bill of Internet Rights, the debate between multiple actors was made possible: members of civil society, academia, government, regulatory and private companies.
As early as 1980, the Committee of Ministers of the Organization for Economic Co-operation and Development (OECD) published the Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, establishing basic principles on data protection and information mobility between countries with laws and regulations in accordance with these principles.
The Organization of American States – OAS, of which Brazil is a Member, has been engaged in exploring normative issues regarding data protection since 1996, with a mandate that provides for a “comparative study on the different legal regimes, policies and mechanisms application of the protection of personal data, including domestic legislation and self-regulation, with a view to exploring the possibility of a regional regulatory framework.” Likewise, the OAS Department of International Law has prepared the “Draft Preliminary Principles and Recommendations on the Protection of Personal Data”, in which the organization’s concern to protect the flow of information and personal data in the Americas is evident. In addition, more progressive tendency of the doctrine on Internet Law usually characterizes the access to the networks like a human right.
Despite all this concerns, through national and international instruments for the promotion of privacy and protection of personal data, Brazil nevertheless is behind by not having in force, in its normative framework, a law establishing, among other things, an authority responsible for the formulation of security guidelines and protocols to be used by companies that use personal data, transparency on the uses of such data and regulation regarding the responsibility for the storage, processing and integrity of the data collected.
In such a context, the security of the private data provided through the use of “free wi-fi” is questioned, especially when compared to the normative framework in force in the European Union, under the European Parliament’s Directive (EU) 2016/680. The premise of user privacy is waived as an inherent right to access this public service, with the potential privacy violation of users of these programs.
Final considerations
The analysis of the Wi-Fi program and the implementation which we are observing in the city of São Paulo allows us to verify the influence of the managerial management model of the public administration, in which municipal public power is reduced to a managerial State based on the model of inspection and regulatory agencies. To this management model, however, some criticisms are opposed, especially with regard to the increasing participation of the private sector in the provision of public services.
As we progress towards characterizing accessibility to the internet as a fundamental human right, a practice essential to the exercise of citizenship, this financialisation of the public economy under the umbrella of an “intelligent city” can entail significant costs to the population, mainly through the legal possibility of releasing access to personal data and transferring them to third parties, as of the current announcement of improvement of the free wi-fi of the city of São Paulo. While public administration invests in entrepreneurship, acting as an inducing agent of private economic development, the citizen, for whom the primary obligation of protection is conferred, is neglected.
In a context in which private companies that control data of individuals, the false duality between privacy and access to public services is imposed on citizens, who are urged to give up part of their browsing intimacy when they use the public services of wi-fi in the city. Unlike the European model, which adopts criteria centered on the figure of the State as guarantor of protection, the alternative of the managerial model places the duties of diligence with the data in the hands of the companies that collect, transfer and treat them. As there is no national regulatory framework regarding privacy and data protection that these companies should observe today, the user of those services would be clearly harmed.
Authors’ note:
This blog post is a text adaptation originally presented at the V International Symposium LAVITS | Surveillance, Democracy and Privacy in Latin America: Vulnerabilities and Resistance in Santiago, Chile. The original text can be found here.