The e-Discovery and Information Governance Law Review: Brazil


i Litigation

Brazil does not have a discovery procedure and, in the context of legal claims, is unfamiliar with the concept of electronic discovery (e-discovery) and the rules of electronically stored information (ESI). There are no laws or regulations that provide how parties or judges should behave in this scenario. In other words, Brazil, which is a civil law jurisdiction, does not provide or demand the use of discovery in legal claims.

In March 2016, the new Civil Procedure Code (CPC) entered into force after several years of discussion before the legislative branch, and many new ideas – including some inspired by the common law system, such as the binding precedent rule – were introduced to a system that had experienced few substantial changes for decades. However, none of the new concepts had a significant impact on the evidence procedure phase.

This does not mean that parties cannot decide to have their specific case processed according to the rules of discovery and ESI. The CPC provides that parties may jointly determine the procedural rules of a current or future dispute, which allows them the opportunity to use discovery and ESI as a way of gathering and producing evidence for a case. This is an opportunity that has not been used very frequently to date, not only as a result of the lack of information regarding the proceedings related to e-discovery, but mainly because judges have the final say regarding how cases are conducted and define the legal issues that must be solved by evidence production or by an analysis of the law. The courts are inundated with thousands of legal proceedings, and the notion that some cases should be conducted in a special manner by the courts, as defined by the parties themselves, does not elicit the sympathy of judges, who have the power to overrule or to modify parties' decisions based on the argument that it is their responsibility to deal with all cases in a fair and equal manner. The costs related to this procedure are also an obstacle.

Regardless of legislative changes, the way that evidence is produced has not substantially changed, as parties remain responsible for producing evidence of the facts either to use against the opposing party or to justify their own position. Electronic evidence accounts for a significant portion of the evidence that is presented to courts, especially in relation to business conflicts, but each party is responsible for producing its evidence without having full access to the evidence that the opposing party has in its files.

In addition, all evidence must be presented before the judge, mostly in his or her physical presence or, in the case of technical evidence (e.g., engineering or accounting evidence), before an individual who is competent to review it. These individuals are appointed by the judge as persons that have his or her confidence, based on each individual's expertise and the quality of his or her work. Cross-examination and full access to the other party's files have no legal basis and are methods that are not commonly used by lawyers.

The official use of e-discovery in proceedings is still unlikely to be introduced as this decision rests with the legislative branch, which is currently extremely busy dealing with corruption accusations. In addition, the use of discovery is at odds with Brazilian legal culture, which does not appear to be willing to accept that parties must be able to access each other's files.

ii Internal investigations

With regard to internal investigations, there is no specific legislation or guidelines that determine how to conduct e-discovery in an investigative process. Internal (or corporate) investigations are a recent innovation, and public authorities and the majority of organisations are not accustomed to the procedures that govern the process. Thus, lawyers and external counsel rely on international best practices to guide the investigation process.

External counsel (lawyers or forensic auditors) frequently lead or oversee internal investigations because of their expertise in evaluating facts, and, with regard to lawyers, because of the legal protection afforded by attorney–client privilege.

The adoption of foreign practices has resulted in cultural clashes in the conduct of internal investigations. For example, for data collection in most countries, it is advisable that when starting an investigation, a company should issue a preservation notice and obtain consent from employees prior to the collection of data from corporate devices. However, in Brazil this guidance has resulted in a massive deletion of data.

Another cultural clash that directly impacts e-discovery in internal investigations is the lack of comprehensive internal controls in some companies, including those that relate to the backup of information and data storage capacity. The resulting lack of information in this regard has led to several inconclusive investigations.

The general approach to e-discovery in internal investigations comprises the following steps:

  1. an assessment of an allegation and the formulation of an investigative plan;
  2. evidence collection, preservation and processing;
  3. electronic document review and evidence analysis; and
  4. an overall assessment and consideration.

Regardless of the structure of the investigative process, the better the depth and quality of the information gathered through e-discovery, the more prepared and informed counsel is to assess the impact of findings on a company's corporate policies, legal requirements and reputation. As an investigation is being conducted, this process may become cyclical if the assessment of certain findings leads to modifications to the investigation plan.

Despite there being no formal e-discovery procedure or recognition of ESI disclosure, in practice, e-discovery plays a crucial role in internal investigations, particularly in the first stages that involve evidence retention and review.

Year in review

i Litigation

The CPC entered into force in 2016 and, along with making certain processes more efficient, introduced the following important changes, among other things:

  1. encouragement of parties' active participation in conducting legal proceedings;
  2. promotion of in-court and out-of-court mediation as an effective way of dispute resolution; and
  3. greater predictability of higher court decisions (including the Supreme Court).

The CPC also introduced other changes that may imply the recognition of the discovery procedure in Brazilian law or, at the very least, a reinforcement of practices related to it.

The first change is the provision of a procedural agreement, which allows parties to create or stipulate the rules of procedures, within the limits of public policy, and allows parties to control a case alongside the judge. This innovation, which has been inspired by arbitration practices, means that procedures could be structured according to the needs and peculiarities of each case and, further, that parties can stipulate discovery rules.

However, it has not been fully explored by parties to date, and it has generally only been used for simpler purposes, such as electronic subpoenas and changing the order of the procedural steps. As previously mentioned, one reason for this is that parties require the judge's approval, which may not be easy to obtain.

The CPC does contain certain timid provisions that resemble the discovery procedure. The first is early evidence, which was enhanced to be an effective mechanism to resolve emerging disputes and prevent the submission of a complaint before the court. When submitting early evidence, a party will ask the judge to consider the evidence in light of another conflict arising. The judge's decision may not only contribute to a better understanding of the current conflict, but may also help the parties to reach a settlement. Early evidence can be any type of evidence, such as the hearing of witnesses, accounting or engineering evidence, and a request for disclosure of specific documents.

ii Internal investigations

The most high-profile corporate investigation currently under way involves Brazil's state-run oil company Petrobras and its developments that now cover several different sectors of the economy. This investigation, known as Operation Car Wash, which began in March 2014, has exposed endemic political corruption and has prompted a number of spin-off investigations. Law enforcement bodies are now emphasising that allegations of wrongdoing must be addressed internally.

Authorities and regulators have also been welcoming the assistance of internal investigators to strengthen leniency agreements, considering factors such as a corporation's willingness to expose employees' or management's wrongdoing. In January 2018, Law No. 13,608 was published, which authorises telephone hotlines and provides rewards for whistle-blowers who offer information that prevents, represses or determines crimes or administrative offences. However, the Law is not being effectively enforced owing to a lack of clear regulations.

New legislation establishing regulations on e-discovery and internal investigations is not anticipated. However, since 2014 there have been certain ongoing issues, one of which is timing. The authorities generally conduct their own investigations to gather the evidence necessary to ensure convictions, although legal entities and individuals seeking to cooperate and obtain benefits may voluntarily present evidence of wrongdoing and illicit acts under Law No. 12,846 of 2013 (the Clean Company Act)2 through leniency agreements and plea deals. Article 16 of the Clean Company Act establishes that leniency agreements must result in the identification of those involved in the wrongdoing, or in the rapid gathering of information or documents that prove the wrongful act under investigation.

For companies and individuals seeking to self-disclose, e-discovery has been crucial. Evidence such as emails, invoices, bank statements, notes and calendar appointments not only corroborate allegations, but also lend efficiency to negotiation processes by avoiding a new e-discovery process led by the authorities themselves.

At the stage of leniency agreement negotiations, authorities have requested independent investigators to present the methodology of their work, with the intent to understand whether e-discovery was performed observing best practices in connection with data collection, preservation, processing and review. Evidence obtained observing rigorous standards of e-discovery has resulted in successful agreements and, consequently, contributed to anti-corruption efforts in Brazil.

The year 2021 has brought intense discussion concerning Brazil's cooperation framework. At the federal level, there are four main agencies with the power to negotiate and enter into leniency agreements: the Public Prosecutor's Office, the Ministry of Transparency, the Office of the Comptroller General and the Attorney General of the Federal Court of Accounts.

Depending on the case, there are other Brazilian authorities who may have competence to address conversations with companies seeking a corporate resolution, such as the Administrative Council for Economic Defence, the Securities and Exchange Commission and the Central Bank of Brazil. It is a complex and plural framework with different agencies and attorneys possessing different responsibilities and competences. The cooperation framework reinforces several principles set forth in the Clean Company Act, including that cooperation from those involved in wrongdoing must produce evidence and provide information about others involved in the illicit practices.

If, in the course of an investigation, the review of ESI indicates evidence of wrongdoing and there is intent to cooperate, the robustness of the methodology, observance of best practices and rigorous standards of e-discovery should be taken into account. There are particularities to the review and delivery of ESI in respect of the negotiation of agreements.

The review of ESI is responsible for the production of evidence, and when there is an expectation to deliver information to the authorities, the data review must be complete, organised and provide (i.e., reconstruct) the modus operandi of the illicit act through the identified evidence. Considering there are multiple authorities that seek to engage in agreements but that also have the competence to receive information and prosecute, it is important to identify all the information that has been presented to the authorities and that has been revealed through e-discovery; if evidence is discovered through the review of ESI and presented to authorities, it must be identified not only by its document identification number but also by a watermark.

Evidence that is presented to the authorities during a negotiation cannot be used against the company or individual for prosecution purposes. The current cooperation framework also includes the premise that companies that seek agreements will implement effective compliance programmes and monitoring of their implementation. Despite it being a less common activity of e-discovery, to gather evidence of an effective programme, information must be reviewed and provided, indicating the existence of internal controls, reporting lines and monitoring of red flags, among other things. In this sense, e-discovery will also be necessary to demonstrate to authorities that not only does the programme exist but it is also effective.

Control and preservation

i Litigation

As there is no legal procedure for discovery, the concept of control in the context of ESI is not applicable.

ii Internal investigations

Not all companies have invested in data storage plans or clear retention policies and controls; therefore, investigators must understand which ESI is relevant for an investigation and if it is available. If the information is stored on a company-owned device, it may be collected. The most common sources for collection are:

  1. mobile phones;
  2. emails (from desktops, on-site laptops, tablets and any other corporate devices);
  3. electronically stored written documents;
  4. instant messages;
  5. network systems that log calendars and events;
  6. backup tapes;
  7. cloud storage;
  8. SD cards, USB drives and external hard drives;
  9. shared directories; and
  10. restored deleted files.

Relying on good-faith efforts of employees to ensure the preservation of relevant ESI has also been a challenge. It is not uncommon for investigators to find that key information has been deleted immediately before or during the data collection and preservation process; rather than being preventative, notifying employees or issuing hold notices has resulted in the destruction of evidence. A well-maintained chain of custody can help to protect investigators and companies from being questioned by authorities if evidence has been destroyed.

Preservation is limited to the observance of employee privacy rights. The labour courts have decided that a company may monitor and retain information from corporate devices supplied by it. Considering that it is common for employees to use corporate devices for personal communications, it is recommended to have employees sign a policy or a consent form that clearly states that the information available on corporate devices is subject to retention and review. Personal devices, even if used for business purposes, may not be accessed by internal investigators unless authorised by the user. In that respect, employers are advised to prohibit the use of personal devices for corporate matters.

Challenges abound with regard to the review of ESI that is personal in nature but not explicitly covered by the law, such as income tax declarations, bank statements, passwords and health information.

Despite the absence of rules and sanctions for failure to preserve documentation, investigators who do not thoroughly check servers, databases and archives for relevant documents may be held accountable for conducting an investigation in a reckless manner or engaging in deliberate fraud if the results of a probe are disclosed to authorities.

Requests and scope

As there is no disclosure procedure, parties do not need to meet and confer in the context of disclosure of ESI.

The CPC provides that a party may request the disclosure of specific documents prior to the start of a lawsuit through the early evidence procedure or during the course of a lawsuit. The interested party will ask the court to order the other party or a third party to disclose a certain document that is in its possession.

One of the following three conditions must be met for a party to seek and obtain a judicial order for disclosure of specific documents: the opposing party has a legal duty to share the document; the opposing party claims that it has a document that supports its position but fails to submit it before the court; or the document belongs to both parties as a result of its contents.

According to the CPC, a party may refuse to disclose a specific document for the following reasons:

  1. if the document is related to the private life of any individual in the party, or if disclosure might compromise the duty of confidentiality to an individual or a third party, and any relatives up to the third degree, and disclosing the document presents a risk of criminal prosecution;
  2. if it would entail disclosing facts that it, by order of the state or for professional reasons, must keep confidential (e.g., a memorandum by a lawyer to his or her client); and
  3. if there are other serious reasons that, according to the court's discretion, justify the refusal.

If a party fails to justify its reasons for not disclosing requested documents, the court may order inductive, coercive, mandatory or subrogation measures for the document to be presented in court. These measures may also be taken against third parties that refuse to disclose a document without justification. If the measures are not successful, the court may presume and legally consider, for a specific case, that the facts related to the documents that were not disclosed are true.

Review and production

i Litigation

As there is no disclosure procedure, the use of advanced analytical tools (e.g., technology-assisted review or predictive coding) to facilitate analysis, review and production is not applicable.

ii Internal investigations

Reviewing ESI in the context of an internal investigation is challenging, considering that the scope of most investigations is broad and communications concerning wrongdoing are often unclear or coded. Analytical tools, predictive coding and search technologies are starting to become available, but are not commonly used. Investigators should construct their keywords and queries with the aim of narrowing down the scope of documents to identify evidence. The investigative team should also consider specific 'free searches' within metadata files, such as 'to', 'from' and 'subject'. Search parameters, data ranges and various search methodologies should be explored.

Imprecise or careless search terms may be considered as an attempt to carry out evasive investigations that focus on irrelevant results.

The time frames for e-discovery and review of ESI depend on the number of documents available for analysis. To date, internal investigations in connection with Operation Car Wash have usually lasted from six to nine months. Investigations related to wrongdoing other than corruption are usually completed within three months.

An important aspect to consider relates to understanding the nature of ESI available for investigation. The use of instant messaging has vastly increased in the past few years and, in Brazil, most employees and businesses communicate with each other and with clients via WhatsApp.3 This adds a layer of complexity to the collection and preservation of user data, but if it fails to be considered in investigations, critical evidence will be missed.

Privacy issues

The CPC grants the possibility of disclosure of specific documents, provided that the party requesting disclosure produces evidence of its right to do so. The opposing party may argue that a document is confidential and may refuse to present it before court, as provided by Article 404, IV, of the CPC.

On 14 August 2018, the then President Michel Temer enacted the Brazilian General Data Protection Law (LGPD), Law No. 13,709 of 2018, which is very similar to the EU General Data Protection Regulation. Following 18 months of vacatio legis, the LGPD became effective in August 2020.

As a result of the LGPD provisions concerning the collection, use, processing and storage of personal data, companies will have to revisit their policies to ensure that employees are aware that information contained on corporate devices is subject to internal monitoring. Consequently, the use of personal devices for the exchange of corporate emails or business communications should be prohibited.

Consequently, information governance programmes will have to be revisited in light of the LGPD; a well-maintained programme and a retention policy are key tools for companies to ensure the preservation of ESI.

Outlook and conclusions

Considering the corruption investigations of the past few years, legislative developments regarding e-discovery may be introduced, although it is unlikely that the legal framework will change substantially. Uncoordinated efforts between authorities may be extremely harmful to anti-corruption efforts. This is all against the backdrop of the elected president's pledges to root out corruption. Within this delicate situation, e-discovery has proven to be effective and crucial in the fight against corruption, requiring not only the identification of wrongdoings but constant monitoring.

Brazil is witnessing a shift in corporate culture concerning corruption and bribery schemes. As corporations' anti-corruption efforts and monitoring of compliance programmes have become routine practice, new guidelines, protocols and tools related to e-discovery and internal investigations are likely to be created. How and when these will be implemented remains an open question.


1 Eloy Rizzo is a partner and Victoria Arcos is an associate at Demarest Advogados.

3 According to the Harvard Business Review, 96 per cent of Brazilians with access to a smartphone use the app as their primary method of communication: is-about-more-than-just-messaging.

The Law Reviews content