Embed Size (px)
Citation preview
w w w . p i n h e i r o n e t o . c o m . b r
No. 18May 2018
DATA PRIVACY
▫ GDPR about to go live▫ Cyber risk and cloud storage regulation of financial services▫ Federal government final report on IoT
TAX
▫ ICMS on digital goods in São Paulo▫ New tax compliance program launched by the State of São Paulo ←→
↑ back to top
1
This bulletin is meant for general informational purposes only and should not be relied upon as legal advice on any specific deal or matter. If you need more information, please contact our lawyers or visit our website www.pinheironeto.com.br.
TECHNOLOGY
A newsletter on technology, media, telecommunications and internet. Our practice group gathers knowledge from different areas to provide a holistic approach to the most complex legal issues brought by our clients. From telecommunications and audiovisual regulatory matters to tax, labor and intellectual property, Brazil is not a country of simple answers; an approach taken by a global company in another jurisdiction may need to be considered from surprising new angles.
PUBLICATION FREQUENCY Monthly
SUPERVISING PARTNERS Raphael de Cunto
CONTRIBUTORS Luiz Roberto Peroba Barbosa; Leonardo Peres da Rocha e Silva; Larissa Galimberti; Ana Carolina Carpinetti; Carla Cavalheiro; Gabriela de Souza Conca; Tiago Severo Gomes; Beatriz Landi L. Figueiredo; Giovanna Christina Selena Cezario; Giovanna de A. Rotondaro; Barbara Amanda Vilela; Stella Oger Pereira dos Santos; Maria Camilla Arnez R. Coelho e Luiza Fernandes N. R. do Amaral.
CONTACT [email protected]
(IMAGE: FREESTOCKS.ORG FROM PEXELS)
Why is this important?The DEE study is relevant to tech companies doing business in Brazil because of at least two reasons: first, the study has been issued in the context of a growing interest shown by CADE to review commercial conducts involving high-tech markets; second, the study will most likely prompt CADE to be even more careful not to stifle innovation and rivalry when deciding the merger control cases and the investigations on alleged abusive use of market power involving tech companies.
TECHNOLOGY
▪ Competition authority releases report on Uber▫ Government groups to study video game regulations▫ New rules on internet use in Brazil’s 2018 elections▫ Price information in e-commerce▫ New guidelines for Internet Law application
Recent released economic study on the impacts of Uber entry in brazil reveals growing interest in tech markets by the brazilian competition authority The Department of Economic Studies (“DEE”) of the Brazilian Competition Authority (CADE) released in April an assessment of the impact of Uber’s market entry in 590 Brazilian cities between 2014 and 2016. The Working Paper points out to an increasing rivalry between Uber and the taxi apps, and indicated that Uber not only created a new demand, but also conquered some of those customers who already used apps. The DEE study shows that Uber led to the reduction of asymmetric information, since consumers gained access to data such as price forecast, suggested route, among others. An additional impact was
a decrease in taxi rides, which was followed by fare reductions and a subsequent recovery in the number of taxi rides derived from apps.
w w w . p i n h e i r o n e t o . c o m . b r2
No. 18May 2018
DATA PRIVACY
▫ GDPR about to go live▫ Cyber risk and cloud storage regulation of financial services▫ Federal government final report on IoT
TAX
▫ ICMS on digital goods in São Paulo▫ New tax compliance program launched by the State of São Paulo
TECHNOLOGY
▫ Competition authority releases report on Uber▪ Government groups to study video game regulations▫ New rules on internet use in Brazil’s 2018 elections▫ Price information in e-commerce▫ New guidelines for Internet Law application
←→↑ back to top
(IMAGE: JAROSLAV NYMBURSKÝ FROM PEXELS)
Why is this important?If video game is included within Ancine’s scope of authority, regulation will Likely involve the payment by game developers and/or publishers of the Contribution for the Development of the National Cinematographic Industry (CONDECINE) as well as incentives for the development of the local market. In the audiovisual industry, these incentives include, among others, mandatory quotas for national productions in distribution windows, and a heavier tax burden on foreign products.lack of detail and context for this purpose.
Superior Cinema Council and Ancine create working group on video gamesThe National Films Agency (Ancine) set up a working group to study and propose how to integrate video games into Ancine’s scope of authority, and to produce public policy proposals for the video game industry. The group is composed of 8 members of Ancine’s staff, and is expected to present its proposal in early May, 2018.
Ancine’s working group was a response to an earlier recommendation from the Superior Cinema Council (SCC) to Ancine to adjust its regulations so as to include video games in public policies aimed at the audiovisual industry. The SCC also created its own working group to propose a public policy for the development of the video games’ industry in Brazil, as well as to follow up and give subsidies to Ancine on this matter. Members of the SCC’s group were drawn from the Ministry of Culture, Ancine, the Ministry of Industry, International Commerce and Services, and from associations within the audiovisual and video games industries.
The creation of these working groups follows a series of efforts by Ancine to regulate video games. In the past, Ancine has produced a Regulatory Impact Report reviewing the video games industry, has sponsored a public debate on games regulation, and has recommended governmental actions to promote the industry. Ancine has also released public resources from the Audiovisual Sectorial Fund (FSA) to finance the development of Brazilian games projects.
Ancine’s authority to regulate video games is not free of doubt.
This is not the first time Ancine attempts to expand its authority to unregulated activities. The regulation by Ancine of video on demand (VOD) and digital advertisement are both unfinished debates of the same type. Like video games, none
of these market segments is considered a part of the audiovisual industry under Brazilian law, so regulation depends on legislative action and not simply a normative ruling issued by Ancine. Ancine seems to have understood and agreed that regulation must come from lawmakers. In digital advertisement, it has suspended the effectiveness of a normative ruling previously issued on the matter, while on VOD, Ancine acknowledged in a public report that “the regulation of VOD depends on the creation of a law” and that “the legislative branch, and not ANCINE, is responsible for conducting this market’s regulation process”
w w w . p i n h e i r o n e t o . c o m . b r3
No. 18May 2018
DATA PRIVACY
▫ GDPR about to go live▫ Cyber risk and cloud storage regulation of financial services▫ Federal government final report on IoT
TAX
▫ ICMS on digital goods in São Paulo▫ New tax compliance program launched by the State of São Paulo
TECHNOLOGY
▫ Competition authority releases report on Uber▫ Government groups to study video game regulations▪ New rules on internet use in Brazil’s 2018 elections▪ Price information in e-commerce▫ New guidelines for Internet Law application
←→↑ back to top
Price information in e-commerceBrazilian lawmakers continue to address consumers’ concerns related to e-commerce. The recently enacted Law nº 13.543 details how prices for products and services must be displayed in e-commerce transactions. A requirement for clear and prominent display of the price along with an image of the product or a description of the service must be coupled with the obligatory use of characters with font size not smaller than 12.
Why is this important?This regulation affects all business offered to consumers online and became effective on the date of its publication, which requires immediate adaptation of business practices by e-commerce companies.
Superior electoral court approves rules for Brazil 2018 general electionsThe Brazilian Superior Electoral Court approved several rules for political campaigns on the Internet. One relevant innovation refers to paid advertising and is based on the 2017 electoral reform (Law No. 13,488/2017). As of the upcoming 2018 elections, content boosting (a tool or service that increases the audience of an existing content on Internet platforms) will be allowed, but may be purchased only by political parties, coalitions, candidates or their representatives.
Although the Justices of the Superior Electoral Court expressed concerns about the fake news on the Internet and their impact on the elections, this issue has not been regulated yet.
Another relevant matter brought by the new
Why is this important?Internet tools play a key role in elections throughout the world as political campaigns become increasingly dependent on internet strategies. It remains to be seen whether regulations will achieve their design to balance business and democracy goals.
regulation is the prohibition of campaign virtual currency fundraising and general expenditure. The prohibition was based on opinions rendered by the Central Bank of Brazil and Securities Commission (“CVM”), which indicated risks in transactions using this type of digital asset.
use of data and obtaining consent.
BRAZILIAN VOTING MACHINE (IMAGE: CAROLINE TATSCH/ASCOM DPERS)
w w w . p i n h e i r o n e t o . c o m . b r4
No. 18May 2018
DATA PRIVACY
▫ GDPR about to go live▫ Cyber risk and cloud storage regulation of financial services▫ Federal government final report on IoT
TAX
▫ ICMS on digital goods in São Paulo▫ New tax compliance program launched by the State of São Paulo
TECHNOLOGY
▫ Competition authority releases report on Uber▫ Government groups to study video game regulations▫ New rules on internet use in Brazil’s 2018 elections▫ Price information in e-commerce▪ New guidelines for Internet Law application
New guidelines by the internet steering committee on the application of the internet lawThe Brazilian Internet Steering Committee (CGI) published a set of guidelines on the application of the Internet Act and Decree 8,771/2016 (that regulates the Internet Act). The guidelines make a few concepts clearer and give recommendations related to the interpretation of net neutrality and data security rules.
CGI.br is not a regulatory body, but an organization created by presidential decree, composed of members from the government, the corporate sector, NGOs and the academic community. Although CGI.br does not have the authority to issue binding regulations, it retains the role of proposing policies and procedures, recommending technical standards, establishing strategic directives and promoting studies related to the internet governance in Brazil.
Net neutralityThe Internet Act and Decree 8,771/2016 acknowledge CGI's authority to opine specifically on matters related to net neutrality matters.
Decree 8,771/2016 determines that the only permitted exceptions to net neutrality rules are those measures compatible with international standards and aimed to preserve the network’s stability security and functionality. CGI guidelines made clear that “ international standards” should mean the technical specifications contained in the Request For Comments (RFCs) published by the Internet Engineering Task Force (IETF) should be adopted in Brazil.
The guidelines also reinforce that discrimination and degradation of data flow is permitted only to guarantee the stability, security and integrity of the network and explains that this includes guaranteeing the stability of fundamental services such as IP addresses' allocation and solution to security incidents aimed to block or overburden the data flow.
"Discrimination" under the guidelines means blocking, redirecting, filtering or otherwise treating certain data packages different than others. “Degradation" means intentionally harming data transmission in the internet. Examples of permitted exceptions to the non-discrimination rule are the mitigation of Denial of Services attacks (by blocking,
redirecting or filtering the data packages involved) and managing of port 25 to fight spam (by blocking data traffic through Port 25/TCP).
According to CGI the obligation under the net neutrality rules to give equal treatment to all data packages apply both to internet connection providers and to autonomous systems (AS) administrators.
Security and confidentiality in record-keepingThe Internet Law provides record keeping obligations to different players, in an attempt to support law enforcement.
Under Decree 8,771/2016, CGI should also promote studies and recommend procedures, rules and technical and operational standards related to the security and confidentiality of logs, personal data and private communications in the internet. In this context, CGI's guidelines provide that connection logs (date and time of connection from a certain IP address) must be kept by both the autonomous system administrator and the entities using sub-groups of IP addresses (provided by an autonomous system administrator) to provide internet connection to end-users. CGI also clears that (i) date and time
←→↑ back to top
w w w . p i n h e i r o n e t o . c o m . b r5
No. 18May 2018
TECHNOLOGY
▫ Competition authority releases report on Uber▫ Government groups to study video game regulations▫ New rules on internet use in Brazil’s 2018 elections▫ Price information in e-commerce▫ New guidelines for Internet Law application
TAX
▫ ICMS on digital goods in São Paulo▫ New tax compliance program launched by the State of São Paulo
DATA PRIVACY
▪ GDPR about to go live▫ Cyber risk and cloud storage regulation of financial services▫ Federal government final report on IoT
EU’s GDPR to become enforceable at the end of the monthThe European Union’s General Data Protection Regulation (GDPR) will become effective and enforceable on May 25, 2018, two years after being enacted. GDPR’s main objective is to provide to data subjects more control over how their data is used by companies. It introduced heavy penalties for organizations that fail to comply with its rules.
The GDPR has a broad territorial scope, affecting not only EU-based entities, but also entities outside the EU that offer goods or services to European data subjects or monitor their behavior.
Why is this important?The GDPR rules will certainly impact the day-to-day operations of those companies within its reach, which may go beyond the EU. Brazilian companies and affiliates with a digital presence in the EU should carefully review the GDPR impact on their business and the need to comply with these upcoming regulations.
of connection must be specified in UTC and synchronized via Network Time Protocol; (ii) the type of data comprised by the concept of "connection logs" and "internet application access logs" are already specified in the Internet Law; (iii) a court order may determine that additional data is kept, as long as technically possible; (iv) only a court order may request access to logs; and (v) security and infra-structure standards adopted in record keeping must be informed in a clear and transparent manner.
Why is this important?CGI has shed light on important concepts and restates Brazil’s strong commitment to net neutrality. Differently from the United States, net neutrality is a principle adopted by statute, the Internet Act. The guidelines should help unifying court precedents on record keeping obligations, which suffer considerably from lack of consistent application.
DATA PRIVACY
(IMAGE: PEXELS)
←→↑ back to top
w w w . p i n h e i r o n e t o . c o m . b r6
No. 18May 2018
TECHNOLOGY
▫ Competition authority releases report on Uber▫ Government groups to study video game regulations▫ New rules on internet use in Brazil’s 2018 elections▫ Price information in e-commerce▫ New guidelines for Internet Law application
TAX
▫ ICMS on digital goods in São Paulo▫ New tax compliance program launched by the State of São Paulo
DATA PRIVACY
▫ GDPR about to go live▪ Cyber risk and cloud storage regulation of financial services▪ Federal government final report on IoT ←→
↑ back to top
Brazil enacts cyber risk and cloud storage regulation of financial servicesFinancial institutions must now follow cyber risk management and cloud outsourcing regulations issued by Brazil’s National Monetary Council pursuant to its Resolution No 4,658. The new regulation sets guidelines on how these entities must design or adapt their internal controls. Policies and action plans to prevent and respond to cybersecurity incidents must be in place before May 6, 2019, and fully compliant by December 31, 2021.
Despite the Central Bank’s initial intent to the contrary, the regulations confirm that data location and processing may take place outside the Brazilian territory. Among new requirements introduced by the regulation, however, access to data stored abroad must be granted at all times to the Brazilian Central Bank for inspection purposes.
Why is this important?Cybersecurity is a top priority matter for financial services firms today given the growing use of cloud services and the constant threat of cyberattacks. The new rules are likely to impact operation of companies in the financial industry, including fintechs. Although the regulation is limited to financial services, it shows the government’s increasing attention to data privacy matters.
“Internet of things: an action plan for Brazil” – final reportOn April 24 BNDES and MCTIC released their joint study “Internet of Things: an action plan for Brazil”.The report identifies the obstacles for IoT development in Brazil and sets specific goals and initiatives that should be pursued. The main obstacles identified are (i) the lack of infrastructure, (ii) poor regulations, and (iii) the complexity of the legal system.of characters with font size not smaller than 12.
Why is this important?The growth of data flow in an increasingly connected environment shows that IoT will play a significant role in the digital economy. Even though this report does not provide short term solutions, it is certainly a first government-sponsored step towards creating an IoT friendly environment.
(IMAGE: PEXELS)
w w w . p i n h e i r o n e t o . c o m . b r7
No. 18May 2018
TECHNOLOGY
▫ Competition authority releases report on Uber▫ Government groups to study video game regulations▫ New rules on internet use in Brazil’s 2018 elections▫ Price information in e-commerce▫ New guidelines for Internet Law application
DATA PRIVACY
▫ GDPR about to go live▫ Cyber risk and cloud storage regulation of financial services▫ Federal government final report on IoT
TAX
▪ ICMS on digital goods in São Paulo▫ New tax compliance program launched by the State of São Paulo ←→
↑ back to top
State of São Paulo regulates the collection of ICMS on digital goodsThe State of São Paulo issued Decree No. 63.099/17 regulating the collection of Tax on Goods and Services (ICMS) on sales of digital goods by means of electronic data transfer.
According to the new regulation, the website or the electronic platform that offers digital goods by means of electronic data transfer is considered an autonomous establishment and must register with the State taxpayer registry, except if performing only tax free transactions.
The Decree provides that the ICMS is levied
only in case the transfer of the digital goods to the final consumer and the collection is due at the time the goods are transferred to the State where the consumer is located. Previous transactions in the supply chain are exempt.
More recently, the State of São Paulo issued CAT Ordinance No. 24/18 to regulate the collection of ICMS on operations with digital goods and clarify some issues omitted in Decree No. 63.099/17.
According to the CAT Ordinance, digital goods are all non-personified goods inserted in a mass marketing chain. This definition includes of-the-shelf software, programs, games, applications,
(IMAGE: FREEPIK)
electronic files and similar products that can be downloaded or accessed in the cloud, as well as audio, video, image and content permanently transferred. But no ICMS apply to subscription-based models such as streaming.
While this regulation expressly acknowledges tax immunity of books, newspaper and periodicals, it sets forth that the platforms in which they are made available must issue invoices.
The concept of digital goods set by the legislation is quite broad and, although it may be challenged, can affect various online transactions. The new regulation has been in force since January 4, 2018.
Why is this important?In effect since January 2018, Decree no. 63.099/17 and CAT Ordinance No. 24/18 significantly change the tax burden on sales of digital goods in the State of São Paulo and may have a wide range of application.
TAX
w w w . p i n h e i r o n e t o . c o m . b r8
No. 18May 2018
TECHNOLOGY
▫ Competition authority releases report on Uber▫ Government groups to study video game regulations▫ New rules on internet use in Brazil’s 2018 elections▫ Price information in e-commerce▫ New guidelines for Internet Law application
DATA PRIVACY
▫ GDPR about to go live▫ Cyber risk and cloud storage regulation of financial services▫ Federal government final report on IoT
TAX
▫ ICMS on digital goods in São Paulo▪ New tax compliance program launched by the State of São Paulo
New tax compliance program launched by the state of São PauloThe State of São Paulo has recently launched a groundbreaking tax compliance program named “In Compliance”. The program is intended to foster tax compliance and transparency by rating taxpayers according to their tax behavior.
Under this new legislation, the State of São Paulo tax authorities may classify taxpayers into certain categories (A+, A, B, C and D) depending on the following factors: (i) amount of ICMS due and not collected; (ii) consistency between tax returns, tax books and tax invoices issued by the taxpayer; and (iii) tax behavior of the taxpayer´s suppliers.
Taxpayers with good ratings will have access to
Why is this important?São Paulo may be creating a model to be followed by other Brazilian States, cities or even the Union itself.
benefits such as: (i) possibility of remedying any irregularities verified by the tax authorities without penalties; (ii) better conditions for the use and transfer of accumulated tax credits and (iii) simplified renewal of special tax regimes. On the other hand, noncompliant taxpayers will be subject to stricter fiscal monitoring and may lose tax benefits.
SÃO PAULO CITY (IMAGE: JOEL SANTANA / PIXABAY)
