In ADC 91, filed by the Brazilian Association of Internet and Telecommunications Providers (Abrint), the Supremo Tribunal Federal (STF), the federal court that has the final say on constitutional matters, is considering how far public authorities may go in requesting data linked to IP addresses directly from providers in order to identify users. The case concerns Article 10, paragraph 1, of the Internet Civil Framework (Marco Civil da Internet), which governs access to connection logs, application access records, and other user data.
During oral argument, Abrint argued that basic subscriber information should not be treated in the same way as connection logs, which can reveal aspects of a user’s online activity. It also highlighted the dilemma faced by providers: comply with the request and risk disclosing protected information, or refuse and potentially face liability for disobedience.
Justice Cristiano Zanin, the rapporteur, voted to uphold the provision and found that, as a rule, identifying a user by matching subscriber information with connection or application access logs requires a court order. He recognized an exception in cases of extreme urgency involving imminent risk to important protected interests, provided that the measure is documented and later submitted for judicial review. In practical terms, a court order would be the rule, while properly justified urgency would be the exception. Zanin also proposed that the ruling apply only prospectively, while preserving requests made before publication of the judgment record. Justice Dias Toffoli joined his vote.
In ADIs 5,059 and 5,073, which concern Law No. 12,830/2013, Toffoli voted to uphold most of the statute but placed limits on the power to request data directly. In his view, authorities cannot have unrestricted access to any type of information without judicial oversight. Interceptions, call records, messages, and other information protected by privacy rights generally require a court order. Basic subscriber information, limited to full name, parentage, and address, may be requested directly. Toffoli also recognized an exception for access to real-time location data in investigations involving serious crimes, subject to later judicial review.
All three cases were suspended after the rapporteurs issued their votes, and no date has been set for the judgment to resume.