Telecommunications metadata possess immense potential for societal good. Telecommunications metadata is therefore a vital ingredient for the making of a smart city, a city that responds to the socio-economic needs of its citizenry. Data sharing for the public good must therefore be encouraged in respect of retained telecommunications metadata, in addition to the existing law enforcement goals, to expand the benefits society may derive from telecommunications metadata. These benefits include assistance with humanitarian efforts, complementing the open data movement. In this paper we take an exploratory approach and analyze the mandatory telecommunications metadata retention and disclosure regime of Brazil. The aim is to learn how the framework addresses privacy and personal data protections. This regime is assessed with a view of identifying how it may enable and encourage the sharing of telecommunications metadata for the public good, beyond the law enforcement public service function. These outcomes are assessed with a view of proposing a predictable enabling policy and legal environment that allows for the collection, use and sharing of telecommunications metadata. The telecommunications metadata that is the subject of this paper are the uniform resource locators, and the device identifiers and location information. These metadata are assessed in light of the technical architecture vis-à-vis the terms of service of Facebook and Telefonica, as examples. Key issues are highlighted in terms of the status quo and its impact on data collection and sharing for the public good. One such key issue is how to practically obtain the lawful consent of the individual given the technical nature of the metadata and the individual’s ignorance to its operations and functions. An enabling environment may need to be based on a practical framework about the exact types of information the individual may need to be informed about and about which express consent is to be obtained, and what may not be practical. The purpose of collection and use may need to be described in a manner that allows for a dynamic innovation process which may not always lend itself to knowing beforehand what purposes the metadata may be explored for. The re-identification challenge may require a step by step approach, at every collection, use and sharing phase, to ensure better privacy protection along the way, in search for solutions to the humanitarian challenges faced.

SSIG 2017 The ninth South School on Internet Governance; Rio de Janeiro, Brazil; 2017-04-03 - 2017-04-07