Facebook Brasil VPN app data-collection probe now formal investigation

10 April 2019 5:01pm

9 April 2019. By Rodrigo Russo.

The Facebook Brasil preliminary probe by federal prosecutors looking into allegations of improper collection of data in Brazil has been upgraded to a formal inquiry, according to documents seen by MLex.

The tech giant has been under investigation in the state of Bahia since August. Federal prosecutors are looking into the use of a virtual private network, or VPN, owned by Facebook subsidiary Onavo that sends communications from an app via smartphones. A VPN is a private or internal network that allows the creation of a special channel for users in different locations to have secure access to an intranet.

Under Brazil’s Internet law, providers of connection services can’t keep records of the use of Internet apps. Prosecutors say that because the VPN service offered by Facebook allows it to gather data, it could lead to privacy violations. However, during its regular activities as an app provider, Facebook is entitled to collect data with user consent.

The investigation could pave the way for a civil lawsuit against the company or lead to a deal with Facebook to settle the case — which seems to be the preferred route for now.

In a document signed April 5 confirming the upgrade of the probe, federal prosecutors also gave Facebook 30 days to explain whether it’s possible to remove its VPN app from the Brazilian market.

The stated* purpose of the inquiry is to “adopt initiatives with Facebook related to the VPN developed by its Israeli subsidiary Onavo, aimed at preserving the rights to privacy, to intimacy, to the confidentiality of communications, to consumers’ information and the free competition in the Brazilian society.”

The probe was initiated as the result of a complaint filed with prosecutors in April 2018 by attorney Thiago Oliveira Castro Vieira and Pedro Antônio Dourado de Rezende, a computer sciences professor at the University of Brasília.

*MLex translation of Portuguese documents.

GDPR