Legislative production on technology in Brazil is considerably recent compared to countries in the global north, where data protection laws date back to the 1970s. Since then, several European countries have begun to introduce the concept of data protection into their legal contexts, accompanied by the Council of Europe Convention 108 of 1981 and the Data Protection Directive of 1995, which were part of the first steps in regulating the subject. In the United States, the first federal laws on the protection of personal data date back to the 1990s, with the Health Information Protection Act (HIPAA), followed by the Privacy Protection Act (COPPA). In comparison, in Latin America, the legislative process on data protection only began in 2000, albeit very timidly, with Law No. 25,326 in Argentina, followed by the Federal Law on the Protection of Personal Data in the Possession of Individuals, enacted in 2010 in Mexico.

In Brazil, although they do not directly address the issue of technology, the Access to Information Law, the Free Competition Law and the Copyright Law can be considered as a beginning of legislative production related to this issue. However, it was only in 2014 that the debate focused on regulating the internet in Brazil really began, established by the very important Internet Civil Rights Framework. It established the rules for the use of the internet in the country, including the guarantee of freedom of expression, user privacy, net neutrality and the responsibilities of service providers. In 2020, we took another step forward with the implementation of the General Data Protection Law, which established rules for the collection, storage and use of personal data in the country.

Based on this situation, it is easy to see that the regulatory scenario is quite recent, which has resulted in little debate for a large part of the Brazilian population, fostering a scenario of profound digital vulnerability. While countries in the global north have older and well-established regulations on data protection, and consequently have been debating the topic for longer, Brazil is still in the process of regulating this aspect, reflecting not only the lack of adequate regulation that can make the country more vulnerable to abuse, but mainly the lack of public awareness. Furthermore, it is important to consider that the lack of financial, human and technological resources can limit Brazil’s ability to implement adequate security measures to protect citizens from possible rights abuses in the face of exponential technological advances.

In this context, the regulatory system plays a fundamental role in the culture and awareness of a people. In addition to its coercive function, controlling the behavior and actions of individuals, the norm also drives debates and plays an informative role regarding rights and duties. According to Miranda Rosa:

Other important functions performed by law should be mentioned, however, especially the educational, conservative and transformative functions. Regarding the first of these functions, there are interesting studies that demonstrate that the mere existence of a rule of law generally results in the conviction on the part of those who know it, that the conduct recommended in said norm is the most appropriate.

This fact reveals the educational influence of the legal norm, shaping social opinions and, therefore, group behavior through a process of learning and convincing that it is socially useful or good to act in a certain way.

Therefore, by establishing clear and mandatory standards for regulation, legislative production makes it possible to create a culture of responsibility and protection of rights. And, logically, when laws are clear and accessible, citizens are more able to make informed decisions about the use of their data and are more likely to demand protection of their privacy, for example.

Furthermore, legislative production can be an important tool to combat discrimination and guarantee equal rights, including the protection of personal data. This is especially important in contexts where vulnerable groups, such as ethnic or gender minorities, may be at risk of violations of their rights, from the discrimination of marginalized bodies due to social circumstances when they are analyzed and categorized by a system that does not have categories to classify them.

Within this framework, the observance of vulnerability is fundamental in legal relations, which is demonstrated by the principle of vulnerability, widely used in the consumerist context of Brazil. Incorporated into the legal system as a fundamental principle of social justice, it is protected under the prism of the principle of equality, established in the Federal Constitution in the caput of art. 5, which ensures: “All are equal before the law, without distinction of any nature, guaranteeing (…) the inviolability of the right to life, liberty, equality, security and property”. In the words of Bonavides:

The principle of equality must be understood […] in its material, or rather, substantial sense, in which it guarantees unequal treatment for a “weakened” party, so that equality can be achieved. Thus, “the principle of equality determines that equal treatment be given to those who are in an equivalent situation and that unequals be treated unequally, to the extent of their inequalities.

However, it is in the area of ​​Consumer Law where this principle is clearly established, emerging to level consumer relations that favor inequality between the supplier and the consumer. Thus, vulnerability is expressed in the Consumer Protection Code, in art. 4, I:

The National Consumer Relations Policy aims to meet the needs of consumers, (…) as well as the transparency and harmony of consumer relations, in compliance with the following principles: I – recognition of the vulnerability of the consumer in the consumer market.

With the following statement, Almeida discusses the principle of vulnerability:

Those who do not have control over production goods and, therefore, must submit to the power of the owners of these goods. This means that the definition of consumer already describes this vulnerability, this relationship of insufficiency that can occur due to misinformation, fraud or when the producer does not give or does not honor the warranty on the produced good.

Therefore, it is important to highlight that many consumers do not have the necessary knowledge to evaluate the quality and safety of the products they purchase. Furthermore, the lack of clear and precise information about products can lead to mistaken decisions, which can result in financial losses or even harm to the consumer’s health. In this same sense, Moraes explains:

Vulnerability, from a legal perspective, is the principle by which the Brazilian legal system recognizes the quality or condition of those weaker subjects in the consumer relationship, considering the possibility that they may be offended or harmed in their physical or psychological safety, as well as in the economic sphere, by the more powerful subjects in the same relationship.

From this perspective, it is crucial that we understand the relevance of applying this principle in the regulation of Artificial Intelligence, since AI users must be considered vulnerable, since they meet the technical requirements for such a situation. Just like consumers, in the relationship between users and producers and holders of AIs, there is also a clear asymmetry of power in which the most powerful link often has privileged information and resources to influence how AI is used.

Along the same lines of reasoning, it is important to highlight that many users do not have sufficient technical knowledge to fully understand how AI works and its implications. Additionally, AI can be developed in a complex and opaque way, which makes it difficult to understand the decisions made by the technology and its limits. Therefore, ignoring these facts and not properly regulating AI, based on the principle of vulnerability, would expose citizens to risks arising from the inappropriate use of technology, which goes against the principles of justice and equality that are fundamental to the Brazilian constitutional order.

However, we cannot fail to note that consumer legislation, despite its relevance, cannot cover all situations in which vulnerability will be present due to the use of AIs. With the increased use of Artificial Intelligence in various areas, it is common to think that users of this technology are always considered consumers. However, in some cases, users may not know that they are interacting with an AI, which makes it difficult to identify their role in the relationship.

One example of this is the implementation of AI in the Brazilian National Employment System (SINE), in which users can be directed to job openings in an automated manner, without knowing that they are interacting with an AI system. It is worth mentioning that some caveats were identified in this implementation of the New SINE, such as the difficulty that workers face in understanding and questioning the results of intermediations and profiling. In addition, although the Access to Information Law allows access to some information about the system, civil society needs to be aware of specific codes and processes to exercise their rights, which can be an obstacle for many ordinary Brazilians. Another limitation of the New SINE is that, by using the patterns of previous selection processes and projections of hiring probability as the main criteria for recommending vacancies, the system can repeat and reinforce its own histories. As a result, the most vulnerable groups in the labor market, such as young people, women and black people with low education, lack of experience and few qualifications, can be harmed by the system’s logic of displaying vacancies.

Similarly, facial recognition systems can also be implemented without users knowing that they are being monitored by an AI, as is the case in the city of Recife, which began using electronic clocks with facial recognition capabilities spread throughout the city, which can also strengthen algorithmic racism, as well as pose risks to the privacy, freedom of expression and right of association of Recife citizens.

In these cases, it is important to consider that users may not be considered consumers, since there is no clear consumerist relationship established in these situations, and they are not even aware that they are interacting with an AI. All of this demonstrates the fundamental role of the vulnerability principle as a guide in the regulation of new technologies in the Brazilian context, because, just as in the consumerist context, it allows for a balance in the relationships between technology companies and users, protecting the interests of the most vulnerable. This is particularly important in the context of AI, where large technology companies have access to massive amounts of data and processing power, putting them in an advantageous position over users.

In short, the regulation of Artificial Intelligence is an extremely important issue for Brazil, given that the country is not yet at an advanced stage of producing legislation and discussing the topic. The lack of public knowledge about this topic can lead to great digital vulnerability on the part of users and, therefore, standardization can have a crucial pedagogical function, helping to raise awareness in society about the vulnerability of users in the face of various emerging technologies, especially Artificial Intelligence. With this in mind, the principle of vulnerability is essential in the regulation of AI, in order to guarantee the protection of users and the security of their personal data. It is through adequate legislation and the awareness of society that it will be possible to ensure the protection of users and promote the ethical and responsible use of this technology.

References

BONATTO, Cláudio. Controversial Issues in the Consumer Defense Code: principles, concepts, contracts. 3rd ed. Porto Alegre: Livraria do Advogado, 2001, p.46.

BORGES, Luiz Roberto. Consumer vulnerability and consumer relationship contracts. Dissertation (Master’s Degree in Law) – Faculty of Law, University of Marília. Marília, 2010.

BRAZIL. Constitution (1988). Constitution: Federative Republic of Brazil. Brasília: Federal Senate, 1988.

BRUNO, Fernanda. CARDOSO, Paula. FALTAY, Paulo. National Employment System and automated management of unemployment. Derechos Digitales [online]. 2018. Available at: https://ia.derechosdigitales.org/wp-content/uploads/2021/03/CPC_informe_BRASIL.pdf Accessed on: 04/07/2023

DÍAZ, Marianne. El Cuerpo como Dato. Derechos Digitales [online]. 2018. Available at: https://www.derechosdigitales.org/wp-content/uploads/cuerpo_DATO.pdf. Accessed on: 04/05/2023

FERNANDES, André Lucas. PEREIRA, Marcos César M. VALOIS, Rhaiana. ON THE “ROAD TO THE FUTURE”?: Narrative discourses and risks in the implementation of technological innovation programs by the city of Recife. Lacnic [online]. 2022. Available at: https://descargas.lacnic.net/lideres/2022/lacnic-lideres_fernandes.pdf?fbclid=IwAR2i1aPKpYzjH5dnARS48Be6UPZx3Ij0DOKtu4WOiYiuy9ELB6-oaVLEvb8 Accessed on: 04/15/2023.

ACT NO. 8,078, OF SEPTEMBER 11, 1990. Consumer Protection Code.

MIRANDA ROSA, Felipe Augusto de. Sociology of Law: The Legal Phenomenon as a Social Fact. 1970. 13th edition, Rio de Janeiro, Jorge Zahar Editor, 1996.

VASCONCELOS, Vanessa Lopes. et al. The Principle of Vulnerability in the CDC in light of the Principle of Constitutional Equality. Undergraduate Notebooks of the FLF [online]. 2014. Available at: http://www.faculdade.flucianofeijao.com.br/site_novo/cadernos_graduacao/servico/Cad_Grad2014/O_PRINCIPIO_DA_VULNERABILIDADE_NO_CDC.pdf Accessed on: 04/15/2023.

Carolina Branco

Undergraduate in Law from the Federal University of Pernambuco (UFPE). At IP.rec, she works in the areas of Virtual and Augmented Reality Technologies and Artificial Intelligence.