Why Brazil's privacy push could cost firms dear

Sooraj Shah examines the implications for global businesses of the Brazilian government's controversial data sovereignty plans

The leaks by former National Security Agency (NSA) contractor Edward Snowden have led to widespread condemnation in the world’s media of state-sponsored snooping, and have also highlighted business concerns over where their data is stored – an issue usually referred to as data sovereignty.

Many firms’ customers are put off by the idea of their data being stored in the US, where the Patriot Act gives the government the authority to access any files that might have some bearing on national security.

Brazil is so concerned about data sovereignty that it is pushing through legislation, dubbed Marco Civil da Internet, that would compel US technology giants such as Google and Facebook to store Brazilian citizens’ data in Brazil. The country has moved swiftly to thwart foreign spying after reports of mass surveillance by the US on Brazilian internet users – and accusations that the NSA tapped into state-run energy giant Petrobras as well as intercepting data from Brazilian President Dilma Rousseff’s office.

In response to criticisms of Marco Civil da Internet from Google, Brazilian communications minister Paulo Bernardo recently told reporters that the government would stick to its plans, and sees no technical justification for scrapping the draft bill.

Google still insists, however, that the proposed legislation may “risk denying Brazilian users access to great services that are provided by US and other international companies”.

But there are deeper reasons behind technology giants’ reluctance to set up shop in Brazil. One is that the cost of building a data centre in Brazil is extortionate. According to Frost & Sullivan analyst Fernando Belfort, it is 40 per cent more expensive to build a data centre in Brazil than the US.

“Everything is expensive in Brazil – the cost of land, the hardware, the blade servers, particularly hardware that is tied to the cloud or any new trends,” he said.

Why Brazil's privacy push could cost firms dear

Sooraj Shah examines the implications for global businesses of the Brazilian government's controversial data sovereignty plans

In September, SAP’s managing director of Southern Latin America, Diego Dzodan, said that as a result of the NSA’s alleged snooping on Brazilian organisations, the German firm would eventually set up its own data centres in the country. He also argued that “unlimited” potential for growth in the South American country would make the investment worthwhile.

Multinationals face steeper costs

Global firms like Google and Facebook fear that if more countries follow Brazil’s lead they will have to build many more costly national data centres, and no longer get away with running just one or two per continent.

And Miriam Wugmeister, partner and chair of law firm Morrison & Foerster’s global privacy and data security group, told Computing that if the legislation were passed as currently drafted, it would not just affect technology companies but “every company that has a computer or relies on technology companies”.

She explained that the ramifications of the Brazilian legislation are not clear as it fails to make explicit whether the actual servers of a company have to be in Brazil or whether it just means that no one outside of Brazil can access the data.

She warned that it could be costly either way. “If it means that no one outside of Brazil can access the data, the cost of any consumer business that provides 24/7 customer support will be vastly more expensive because those companies will not be able to have a ‘follow the sun’ model; it means that all technical support will have to be duplicated in Brazil where the skills and expertise may not yet exist or may be much more expensive to supply,” said Wugmeister.

The Brazilian government has indicated that if the physical aspect of data storage does not form part of the Marco Civil, it will seek to draft separate legislation to protect its citizens’ data a later date.

Antonio Gil, president of Brasscom, Brazil’s technology industry trade body, said the outlook in Brazil in terms of IT market growth was extremely positive, with double the average market growth in the world, second only to China and above India. IT investment growth in 2011-12 for Brazil was 10.8 per cent, trailing only China with 15 per cent growth, he said.

If this is the case, and if the law is inevitably going to be pushed through, then perhaps technology companies with a large client base should follow SAPs lead in pushing forward with plans to build data centres in Brazil, as costs may rise as competition increases.

The potential downside is that the added layer of privacy could affect services and innovation in the countries that seek to implement such legislation.

@Sooraj_Shah