Recently, we commented here on the blog about how smartphones have become “treasure chests” for investigation authorities. The term is not exaggerated: these little gadgets that we carry daily wherever we go and that we only let go — not before one last check — before we sleep are full of extremely valuable information for crime solving: contact lists, notes and text libraries, photos, email inbox, instant messaging and Internet navigation histories and localization information. Now imagine if, for having used your cell phone near where a crime happened, you would have to reveal all this information, even if there were not specific suspicions about you?

The question is not hypothetic or part of a conspiratory theory. Last year, to investigate a robbery to a security and money transportation company in Ribeirão Preto, the police (judicially) asked for Google, Apple and Microsoft to supply data from all users who were up to 500m from the address, in an interval of 4 days. They were not asking for small things: what the police authorities wanted were the IMEI numbers (unique identifiers of cell phone devices), user data of email accounts and the access registry to them, a relation of places saved in Google Maps, the history of location and travels of these people, the search history (what they searched for!), the stored passwords, and even photos taken, all from the last 30 days.

If forced to supply this information, Google would have to reveal the location and Internet navigation history from ALL the people who passed through that 500m perimeter from the crime’s location during four days. That is, if you had the bad luck of passing around there, the authorities would have access to every restaurant you went, addresses of friends, family members, your work, visitors, and maybe even to some place you would not like to reveal that I’ve been to; and even more than this, every question that you asked Google, every photo you’ve taken, embarrassing or not. Think a little about what you did on your cell phone on the last 30 days and see if that says little about you.

The lower court judge agreed to only part of the request and authorized the breach confidentiality of register data, places saved in Google Maps and of the location and travel history of the past 30 days; Google did not settle, and filed a writ of mandamus in the São Paulo Court of Justice but only got a reduction of the order’s scope; still not settling, it took the case to the Superior Court of Justice. Only then the case began to change.

The judge who reported the case, Antonio Saldanha Pinheiro, in a preliminary injunction, determined that this data should not be handed over. At least so far, since this decision is provisory and might still have a different destiny. The judge was sensible to the argument that the surrender of this data violated the private sphere of users.

What draws the attention in this case is that the investigation authority wanted private data from each and every person who passed through that place in that period, and that, in the lower court, it got the judicial authorization. The order was generic, that is, it was not directed to people who already were suspects of being involved in the investigated crime. This means that all this information of a great number of innocent people would be revealed and analyzed; people who maybe did not even know about the occurrence of a crime in that place. They would be under suspicion and would have their lives exposed simply because they passed around that place.

Many people argue, in these times, that the interest of examining the crime should prevail, after all, “If you’ve got nothing to hide, you’ve got nothing to fear”: who does not have anything to hide from the police does not have anything to be worried about. But is it so? Would we really feel comfortable and act as freely if we knew that our private life can be blown open based on little criteria?

In a democratic state, it is necessary that authorities not only solve crimes, but also respect the fundamental rights and guarantees of citizens. There are several reasons for this balance to be kept. In our criminal and procedural law, the right to privacy is only denied when there is a concrete suspicion of involvement in illegal activities. Our Law of Interceptions, for example, only authorizes someone’s breach of communications when there are “reasonable traces of authorship or participation in criminal infraction” (article 2, I); the Code of Criminal Procedure only authorizes the search and seizure of documents and computers of accused people and when there is a “well-founded suspicion” that they can elucidate the crime (article 240, paragraph 2). To inhibit abuses, the decree that regulated the Brazilian Internet Civil Rights Framework also expressly prohibited “generic or nonspecific” collective requests of register data (article 11, paragraph 3). The logic of this protection is that the more invasive to privacy is a request, the bigger has to be the suspicion or the severity of the crime.

It is up to the investigators to prove who is guilty, and not to people in general to offer information to prove themselves innocent. This is the basis of the principle of presumption of innocence, which is a human right guaranteed not only by the Brazilian Constitution, but also by several international agreements and treaties. And it does not exist independently in the world: it is an important foundation of the constitution of relations between the society and the state. Treating everyone as a suspect without a fair cause, and thus giving the state full access to such private information for so little, is to give it an unmeasured power, which can lead to diverse authoritarian measures, with unpredictable targets.

To allow this much information about thousands of people who were not even related to the crime to be accessed, as it was wanted in the Riberão Preto case, is to ignore all of these precepts. The STJ did very well in the provisory decision. Following the final decision is of the interest of all Brazilians.

See the commented decision here [in Portuguese].

By Jacqueline Abreu and Mariana Valente

Translation: Ana Luiza Araujo