Brazil does not have a discovery procedure and, in the context of legal claims, is unfamiliar with the concept of electronic discovery (e-discovery) and the rules of electronically stored information (ESI). There are no laws or regulations that provide how the parties, or the judges, should behave in this scenario. In other words, Brazil, which is a civil law jurisdiction, does not provide or demand the use of discovery in legal claims. In March 2016, the new Brazilian Civil Procedure Code (CPC) entered into force after several years of discussion before the legislative branch and many new ideas – including some that were inspired by the common law system, such as the binding precedent rule – were introduced to a system that had experienced few substantial changes for decades. However, none of the new concepts had a significant impact on the evidence procedure phase.
However, this does not mean that the parties cannot decide to have their specific case processed according to the rules of discovery and ESI. The CPC provides that parties may jointly determine the procedural rules of a current or future dispute, which allows them the opportunity to use discovery and ESI as a way of gathering and producing evidence for the case. This is an opportunity that has not been used very frequently to date, not only as a result of the lack of information regarding the proceedings related to e-discovery, but mainly because judges have the final say regarding how cases are conducted and define the legal issues that must be solved by evidence production or by the analysis of the law. The courts are flooded by thousands of legal proceedings and the notion that some cases should be conducted in a special manner by the courts, as defined by the parties themselves, does not elicit the sympathy of judges, who have the power to overrule or to modify the parties' decision based on the argument that it is their responsibility to deal with all cases in a fair and equal manner. The costs related to this procedure are also an obstacle.
Regardless of legislative changes, the way that evidence is produced has not substantially changed, as the parties remain responsible for producing evidence of the facts either to use against the opposing party or to justify their own position. Electronic evidence accounts for a significant portion of the evidence that is presented to courts, especially related to business conflicts, but each party is responsible for producing the evidence, without having full access to the evidence that the opposing party has in its files. In addition, all evidence must be presented before the judge, mostly in his or her physical presence or, in the case of technical evidence (e.g., engineering or accounting evidence), before an individual who has the competence to review it. These individuals are appointed by the judge as persons of his or her confidence, based on the individual's expertise and the quality of his or her work. Cross-examination and full access to the other party's files have no legal basis and are methods that are not commonly used by lawyers.
The official use of e-discovery in proceedings is still unlikely to be introduced, as this decision rests with the legislative branch, which is currently extremely busy dealing with corruption accusations. In addition, the use of discovery is at odds with Brazilian legal culture, which does not appear to be willing to accept that parties must be able to access each other's files.
ii Internal investigations
With regard to internal investigations, there is no specific legislation or guideline that determines how to conduct e-discovery in an investigative process. Internal (or corporate) investigations are a recent innovation, and both public authorities and the majority of organisations are not accustomed to the procedures that govern the process. Thus, lawyers and external counsel rely on international best practices to guide the investigation process.
External counsel (lawyers or forensic auditors) frequently lead or oversee internal investigations because of their expertise in evaluating facts, and, with regard to lawyers, for the legal protection afforded by attorney–client privilege.
Adapting foreign practices has resulted in cultural clashes in the conduct of internal investigations. For example, for data collection in most countries, it is advisable that when starting an investigation, a company should issue a preservation notice and obtain consent from employees prior to the collection of data from corporate devices. However, in Brazil this guidance has resulted in massive deletion of data. Another cultural clash that directly impacts e-discovery in internal investigations is the lack of comprehensive internal controls in some companies, including those that relate to backup of information and data storage capacity. The resulting lack of information has led to several inconclusive investigations.
The general approach to e-discovery in internal investigations comprises the following steps: (1) assessment of the allegation and formulation of the investigative plan; (2) evidence collection, preservation and processing; (3) electronic document review and evidence analysis; and (4) overall assessment and considerations.
Regardless of the structure of the investigative process, the better the depth and quality of the information gathered through e-discovery, the more prepared and informed the counsel is to assess the impact of the findings on a company's corporate policies, legal requirements and reputation. As the investigation is being conducted, this process may become cyclical if the assessment of certain findings leads to modifications to the investigation plan.
Despite there being no formal e-discovery procedure or recognition of ESI disclosure, in practice, e-discovery plays a crucial role in internal investigations, particularly in the first stages that involve evidence retention and review (see Sections III.ii and V.ii).
II YEAR IN REVIEW
As mentioned in Section I, the CPC entered into force in 2016 and, along with making certain processes more efficient, introduced the following important changes, among others:
- encouragement of parties' active participation in conducting legal proceedings;
- promotion of in- and out-of-court mediation as an effective way of dispute resolution; and
- greater predictability of higher court decisions (including the Supreme Court).
The CPC also introduced other changes that may imply recognition of the discovery procedure in Brazilian law or, at the very least, a reinforcement of practices related to it.
The first change is the provision of a procedural agreement, which allows parties to create or stipulate the rules of the procedure, within the limits of public policy, and allows parties to control the case alongside the judge. This innovation, which has been inspired by arbitration practices, means that procedures could be structured according to the needs and peculiarities of each case, and, further, that parties can stipulate discovery rules. However, it has not been fully explored by parties to date and it has generally only been used for simpler purposes, such as electronic subpoenas and changing the order of the procedural steps. As mentioned, one reason for this is that parties require the judge's approval, which may not be easy to obtain.
The CPC does contain certain timid provisions that resemble the discovery procedure. The first is 'early evidence', which was enhanced to be an effective mechanism to resolve emerging disputes and prevent the submission of a complaint before the court. When submitting the early evidence, a party will ask the judge to consider the evidence in light of another conflict arising. The judge's decision may not only contribute to a better understanding of the current conflict, but may also help the parties to reach a settlement. Early evidence can be any type of evidence, such as the hearing of witnesses, accounting or engineering evidence, and the request for disclosure of specific documents.
ii Internal investigations
The most high-profile corporate investigation under way involves Brazil's state-run oil company Petrobras. This investigation, known as Operation Car Wash, began in March 2014 and has exposed endemic political corruption, and prompted a number of spin-off investigations. Law enforcement bodies are now emphasising that allegations of wrongdoing must be addressed internally. Authorities and regulators have also been welcoming the assistance of internal investigators to strengthen leniency agreements, considering factors such as a corporation's willingness to expose employees' or management's wrongdoing. In January 2018, Law No. 13,608 was published, which authorises telephone hotlines and provides rewards for whistle-blowers who offer information that prevents, represses or determines crimes or administrative offences. However, the Law is not being effectively enforced owing to a lack of clear regulations.
New legislation establishing regulations on e-discovery and internal investigations is not anticipated. However, since 2014 there have been certain ongoing issues, one of which is timing. The authorities generally conduct their own investigations to gather the necessary evidence to ensure convictions, although through leniency agreements and plea deals, legal entities and individuals, seeking to cooperate and obtain benefits, may voluntarily present evidence of wrongdoing and illicit acts under Law No. 12, 846 of 2013 (the Clean Company Act).2 Article 16 of the Clean Company Act establishes that leniency agreements must result in the identification of those involved in the wrongdoing, or in the rapid gathering of information or documents that prove the wrongful act under investigation.
Another issue relates to understanding the nature of ESI available for investigation. The use of instant messaging has vastly increased in the past few years and, in Brazil, most employees and businesses communicate with each other and with clients via WhatsApp.3 This adds a layer of complexity to the collection and preservation of user data, but if it fails to be considered in investigations, critical evidence will be missed.
III CONTROL AND PRESERVATION
As there is no legal procedure for discovery, the concept of control in the context of ESI is not applicable.
ii Internal investigations
Not all companies have invested in data storage plans or clear retention policies and controls. Therefore, investigators must seek to understand which ESI is relevant for the investigation and if it is available. If the information is stored on a company-owned device, it may be collected. The most common sources for collection are: mobile phones; emails (from desktops, on-site laptops, tablets and any other corporate devices); electronically stored written documents; instant messages; network systems that log calendars and events; backup tapes; cloud storage; SD cards, USB drives and external hard drives; shared directories; and restored deleted files.
Relying on good-faith efforts of employees to ensure preservation of relevant ESI has also been a challenge. It is not uncommon for investigators to find that deletion of key information occurred immediately before or during the data collection and preservation process. As mentioned in Section I.ii, rather than being preventative, notifying employees or issuing hold notices has resulted in the destruction of evidence. A well-maintained chain of custody can help to protect investigators and companies from being questioned by authorities if evidence has been destroyed.
Preservation is limited to the observance of employee privacy rights. The labour courts have decided that a company may monitor and retain information from corporate devices supplied by it. Considering that it is common for employees to use corporate devices for personal communications, it is recommended to have employees sign a policy or a consent form, which clearly states that the information available on corporate devices is subject to retention and review. Personal devices, even if used for business purposes, may not be accessed by internal investigators unless authorised by the user. In that respect, employers are advised to prohibit the use of personal devices for corporate matters (see Section VI).
Challenges abound with respect to the review of ESI that is personal in nature but not explicitly covered by the law – for example, income tax declarations, bank statements, passwords and health information.
Despite the absence of rules and sanctions for failure to preserve documentation, investigators who do not thoroughly check servers, databases and archives for relevant documents may be held accountable for conducting the investigation in a reckless manner or engaging in deliberate fraud if the results of the probe are disclosed to authorities.
IV REQUESTS AND SCOPE
As there is no disclosure procedure, parties do not need to meet and confer in the context of disclosure of ESI.
The CPC provides that a party may request the disclosure of specific documents prior to the start of a lawsuit through the early evidence procedure (see Section II.i) or during the course of a lawsuit. The interested party will ask the court to order the other party or a third party to disclose a certain document that is in its possession.
One of the following three conditions must be met in order for a party to seek and obtain a judicial order for disclosure of specific documents: (1) the opposing party has a legal duty to share the document; (2) the opposing party claims that it has a document that supports its position but fails to submit it before the court; or (3) the document belongs to both parties as a result of its contents.
According to the CPC, a party may refuse to disclose a specific document for the following reasons:
- if the document is related to the private life of any individual in the party, or if disclosure might compromise the duty of confidentiality to an individual or a third party, and any relatives up to the third degree, and doing so presents a risk of criminal prosecution;
- if it would entail disclosing facts that it, by order of the state or for professional reasons, must keep confidential (e.g., a memorandum by a lawyer to his or her client); and
- if there are other serious reasons that, according to the court's discretion, justify the refusal.
If a party fails to justify its reasons for not disclosing the requested documents, the court may order inductive, coercive, mandatory or subrogative measures for the document to be presented in court. These measures may also be taken against third parties that refuse to disclose a document without justification. If these measures are not successful, the court may presume and legally consider, for the specific case, that the facts related to the documents that were not disclosed are true.
V REVIEW AND PRODUCTION
As there is no disclosure procedure, the use of advanced analytical tools (e.g., technology-assisted review or predictive coding) to facilitate analysis, review and production is not applicable.
ii Internal investigations
Reviewing ESI in the context of an internal investigation is challenging considering that the scopes of most investigations are broad and communications concerning wrongdoing are often unclear or coded. Analytical tools, predictive coding and search technologies are starting to become available, but are not commonly used. Investigators should construct their keywords and queries with aim of narrowing down the scope of documents to identify evidence. The investigative team should also consider specific 'free searches' within the metadata files, such as 'to', 'from' and 'subject'. Search parameters, data ranges and various search methodologies should be explored.
Moreover, imprecise or careless search terms may be considered as an attempt to carry out evasive investigations that focus on irrelevant results.
The time frames for e-discovery and review of ESI depend on the number of documents available for analysis. To date, internal investigations in connection with Operation Car Wash have usually lasted from six to nine months. Investigations related to wrongdoing other than corruption are usually completed within three months.
VI PRIVACY ISSUES
The CPC grants the possibility of disclosure of specific documents, provided that the party requesting disclosure produces evidence of its right to do so. However, the opposing party may argue that the document is confidential and may refuse to present it before court, as provided by Article 404, IV, of the CPC. See Section IV.
On 14 August 2018, the then President Michel Temer enacted the Brazilian General Data Protection Law (LGPD), Law No. 13,709 of 2018, which is very similar to the European Union General Data Protection Regulation. Following the 18 months of vacatio legis, the LGPD will become effective in February 2020.
As a result of the LGPD provisions concerning the collection, use, processing and storage of personal data, companies will have to revisit their policies to ensure that employees are aware that information contained in corporate devices is subject to internal monitoring. Consequently, the use of personal devices for the exchange of corporate emails or business communications should be prohibited.
As a result, information governance programmes will have to be revisited in view of the LGPD; a well-maintained programme and a retention policy are key tools for companies to ensure preservation of ESI.
VII OUTLOOK AND CONCLUSIONS
Considering the corruption investigations of the past few years, legislative developments regarding e-discovery may be introduced, though it is unlikely that the legal framework will change substantially. Brazil is witnessing a shift in corporate culture concerning corruption and bribery schemes. As corporations' anti-corruption efforts and monitoring of compliance programmes are expected to become routine practice, new guidelines, protocols and tools related to e-discovery and internal investigations are likely to be created. It remains an open question as to how and when these will be implemented.
1 Eloy Rizzo is a partner, and Danilo Orenga and Victoria Arcos are associates, at KLA – Koury Lopes Advogados.
3 According to the Harvard Business Review, 96 per cent of Brazilians with access to a smartphone use the app as their primary method of communication. https://hbr.org/2016/04/the-rise-of-whatsapp-in-brazil-