Brazil

General context, key principles and hot topics

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

Operation Car Wash is the largest corruption and money-laundering investigation in Brazil. There has been a series of developments since the operation was launched in March 2014 and is continuing, with the latest phase of the operation, the 72nd, held on 18 June 2020.

Several police investigations involving state and municipal governments have been conducted during the covid-19 pandemic in relation to public expenses with health measures. Operation Placebo has been the most prominent in national media, targeting Rio de Janeiro’s state governor, Wilson Witzel.

2 Outline the legal framework for corporate liability in your country.

Criminal liability is personal and subjective, which means that only individuals who have some degree of involvement in a criminal activity may be held liable for it.

In the vast majority of cases, legal entities, such as corporations or other non-natural persons, cannot be charged with crimes, but only for administrative and civil sanctions. The exception to this general rule is criminal liability for environmental crimes (Federal Law No. 9,605/1998). Criminal liability will be imposed on a corporate entity for an environmental crime when the offence is committed (1) as a result of a decision by its legal or contractual representative or by its board, and (2) in the company’s interests or for its benefit.

Federal Law No. 12,846/2013 (the Anti-Corruption Law), which came into force in January 2014, deals with the civil and administrative liability of companies for acts against the public administration, whether national or foreign. The Law determines, in Article 2, the strict liability of legal entities, including for actions of third parties that benefit the legal entity.

The Anti-Corruption Law establishes administrative and judicial sanctions for violations of its provisions.

First, administrative sanctions are:

• a fine ranging from 0.1 per cent to 20 per cent of the gross revenue of the legal entity in the fiscal year prior to the initiation of administrative proceedings, excluding taxes, which shall never be lower than the advantage obtained, when it is possible to estimate it; and
• publication of the condemnatory decision.

If it is not possible to use the gross revenue criteria, the fine will range from 6,000 to 60 million Brazilian reais.

Second, judicial sanctions are:

• loss of assets, rights or valuables representing, directly or indirectly, the advantage or benefit gained from the infringement;
• partial suspension or interdiction of the legal entity’s activities;
• compulsory dissolution of the legal entity; or
• a ban on receiving incentives, subsidies, grants, donations or loans from public agencies or entities, and from public financial institutions or institutions controlled by the government, for between one and five years.

Federal Law No. 8429/1992 (the Administrative Improbity Law) establishes administrative and judicial sanctions for legal entities and individuals whose misconduct, to the detriment of the public administration and public interests, results in illicit enrichment, losses to the public treasury, or violate principles of the public administration.

Under the Administrative Improbity Law, those who commit a dishonest act against the public administration are subject to administrative sanctions such as loss of assets obtained from the wrongdoing (disgorgement), full damage compensation, removal from public function and loss of political rights (for individuals), a ban on receiving incentives, subsidies, grants, donations or loans from public agencies or entities for up to 10 years, a fine of up to three times the value of the undue advantage, and a ban on contracting with the government for up to 10 years.

Contracts entered into with the public administration are also subject to the review of the Court of Accounts. At the federal level, the Federal Audit Court (TCU) is responsible for reviewing contracts with the federal administration. Under Law No. 8443/92 (the TCU Law), any damage caused to the public treasury (e.g., caused by fraud in a public tender) may lead to penalties imposed by the TCU.

3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Initially, it is worth clarifying that in Brazil, because of the multiplicity of sanctioning authorities, whose competence is attributed by different laws, there may be a certain legal uncertainty for companies that are subject to law enforcement in cases of corruption (broad concept) or fraud in bidding processes.

In respect of violations of the Anti-Corruption Law, the highest authority of the relevant agency or entity of the executive, legislative and judiciary branches may investigate the matter and impose administrative sanctions. The Office of the Federal Comptroller General (CGU) has authority to investigate, process and sanction illegal acts set forth in the law that are committed against any foreign public administration.

In the case of the Administrative Improbity Law, those who have legal authority to conduct an investigation include the public entity that suffered the damage resulting from the act of administrative improbity.

Other authorities have power to enforce rules relating to specific legal areas, such as the Administrative Council for Economic Defence, which enforces antitrust violations, and the Securities Commission, which enforces rules relating to publicly traded corporations.

4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

The authorities must be aware of minimum elements of the occurrence of a crime to initiate an investigation. This means that a mere suspicion would not allow authorities to trigger an investigation; however, it is not necessary to have certainty about the occurrence of a crime or about the individuals responsible for it.

According to a Brazilian Supreme Court precedent, no criminal investigation can be initiated based only on anonymous information.

From the perspective of the Anti-Corruption Law, an investigation may be initiated by the CGU or other competent authority having obtained information about an alleged violation following Normative Instruction 13/2019, as amended by Normative Instruction 15/2020.

5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

Individuals and legal entities may challenge the lawfulness or scope of a notice or subpoena from a law enforcement authority in the courts. Depending on the matter, a habeas corpus or an injunction may be filed.

If the notice or subpoena lack elements for the company to identify the allegations, it can be challenged for limiting defence rights.

6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

As of 2019, Brazilian criminal law allows individuals and companies to benefit from a non-criminal prosecution agreement. Non-prosecution agreements (NPAs) are applied to companies only in respect of environmental crimes, which are the only crimes for which legal entities can be held criminally liable.

NPAs can be proposed by the public prosecutor in relation to crimes for which the minimum penalty is less than four years of imprisonment. As part of the NPA, the legal entity must repair the damage caused as result of the offence, carry out community service and pay a fine. The public prosecutor may also opt to impose other obligations on that legal entity.

In June 2020, the Federal Public Prosecutor’s Office released Soft Law (Nota Técnica) No. 1, published by the 5th Coordination and Review Chamber – Combating Corruption, which permits individuals to subscribe to leniency agreements that are entered into by prosecutors with corporations as a means of co-operation.

7 What are the top priorities for your country’s law enforcement authorities?

With the entry into force of the Brazilian anti-corruption legislation in 2014, and the progress of the well-known Operation Car Wash, the main priorities for law enforcement authorities continue to be in respect of acts of corruption (including bribery, fraud, money laundering and administrative misconduct), as well as concerns in respect of environmental crimes. However, considering the competencies of other government agencies, the enforcement of tax, antitrust, banking and capital market legislation is also a priority. These agencies are contemplating and demanding, to an ever greater extent, practices that are consistent with preventive measures and the reinforcement of corporate compliance.

8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?

The Anti-Corruption Law first set out provisions to support the use of compliance programmes by private legal entities. Potential penalties may be reduced by the existence of an internal compliance programme. Pursuant to Federal Decree No. 8,420/2015, which regulates the Anti-Corruption Law, an applicable fine may be reduced by up to 4 per cent.

The CGU establishes parameters for how compliance programmes are taken into consideration when applying fines, and has published an ‘Integrity Programme Evaluation Handbook for Administrative Accountability Procedures’.

Cyber-related issues

9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

Brazil has approved its Data Protection Law, which is due to be effective from 3 May 2021 (although there are still discussions in Congress that may result in this date being brought forward, possibly to 27 August 2020 – see question 22 for further details). The Law requires data controllers and data processors to adopt security, technical and organisational measures to protect personal data against unauthorised access and from accidental or illicit destruction, loss, alteration, communication or any other inappropriate or illicit processing. The Law does not specify in detail the measures that should actually be put in place, but establishes that the regulator (i.e., the Brazilian Data Protection Authority) may establish minimum technical standards for these purposes, taking into consideration the nature of the information being processed, the specific characteristics of processing and the efficiency of the technology used. Further, data controllers and processors are required to adopt privacy by design and privacy by default in their processing activities.

In addition to the above, there are certain cybersecurity guidelines applicable specifically to the public sector.

10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

Brazilian law includes specific norms against cybercrime activities (e.g., hacking of devices and illegal wiretapping). Other norms may apply to illegal activities conducted via the internet, software or hardware (e.g., terrorism, crimes against intellectual property of computer software, crimes against children and teenagers, crimes against honour, racism and xenophobia).

As a rule, cybercrimes are investigated by the state police departments. However, the Federal Police is specifically empowered to investigate (1) terrorism crimes, (2) crimes involving misogynistic activity, or internet activity that amounts to hatred or aversion of women, and (3) crimes that have a transnational characteristic, all of which Brazil is committed (via international treaties) to combat and prevent.

Cross-border issues and foreign authorities

11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

The Criminal Code sets forth the requirements for applying Brazilian criminal law to crimes that have occurred abroad (from start to finish) (Criminal Code, Articles 7 and 8). Brazilian jurisdiction has extraterritorial effect in two sets of possible situations.

The first of these relates to:

• genocide (when the offender is Brazilian or is living in Brazil); and
• crimes committed against:
  • the Brazilian president’s life or freedom;
  • public trust;
  • property owned by public administrative bodies, companies owned by public administrative bodies or public foundations; and
  • the public administrative body, including crimes against an individual who is acting on behalf, or under the orders, of a public administrative body.

An offender who commits any of the above-mentioned crimes should be punished according to Brazilian criminal law even if he or she has been acquitted or convicted by a foreign court.

The second set of situations requires different conditions to be applied according to the type of crime, including those that Brazil is obliged to repress based on an international treaty or convention, or those committed by Brazilian individuals or in Brazilian aircraft or vessels (commercial or private) in a foreign territory if no other court decision on its merits has been issued. In addition, for Brazilian jurisdiction to be applied, all the following conditions should be fulfilled:

• the offender must:
  • be in Brazil for criminal prosecution to begin;
  • not have been previously acquitted by a foreign court or fully served a penalty abroad;
  • not have been acquitted or pardoned by a foreign court; and
  • be criminally liable (e.g., the statute of limitation was not reached);
• the fact must be deemed a crime under the criminal law of both countries; and
• Brazilian law must authorise extradition, in theory, in cases involving an appropriate type of crime.

If a Brazilian citizen is the victim of a foreign individual’s conduct, Brazilian jurisdiction may be applied provided that (1) the above-mentioned conditions are fulfilled, (2) extradition of the offender has not previously been requested or denied, and (3) the Brazilian Minister of Justice has requested the law enforcement authorities to punish the crime.

Note that the hypothesis of jurisdictional extraterritorial effects relates to crimes that occurred abroad (from start to finish). Indeed, if any part of an individual’s action or omission essential to the occurrence of a crime has taken place in Brazil, Brazilian criminal law determines that the crime was committed in Brazil. Also, if an individual’s action or omission essential to the occurrence of a crime has taken place abroad, but its result occurs in Brazil, again the crime is considered to have been committed in Brazil. Consequently, both hypotheses (action or omission and the results in Brazil) would be under Brazilian jurisdiction. This means none of the conditions relating to the extraterritorial effects, as described above, needs to be complied with for the offender potentially to be criminally charged in Brazil.

Finally, Brazilian law applies to crimes that occur in public vessels and aircraft, vessels and aircraft used for public purposes, and private vessels and aircraft (on the high seas or in Brazilian airspace).

12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

Brazilian authorities both co-operate on criminal matters with foreign authorities and request the co-operation of foreign authorities. Co-operation between authorities can involve the execution of acts relating to the collection of evidence (interviews, breach of bank secrecy), transfers of convicted individuals, freezing of assets, among other things, during criminal investigations or lawsuits. Brazil has multilateral and bilateral co-operation agreements with several countries. If there is no existing agreement with a particular, it is possible to enter into a mutual settlement for future situations.

Thus, situations vary depending on the relationship and legislation of other countries. The main challenges faced in cross-border investigations are (1) the time spent waiting for other countries’ answers or proceedings, (2) the necessary observation of formalities to ensure that evidence collected abroad will be considered valid in Brazil (not null or illicit), (3) certain restrictions imposed by relevant data protection laws, (4) blocking statutes, and (5) situations in which Brazil does not have an existing agreement.

13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

As a general rule, double jeopardy is not permitted under Brazilian law. Exceptions apply regarding the extraterritorial effects of genocide (when the offender is Brazilian or is living in Brazil) and crimes against (1) the Brazilian president’s life or freedom, (2) public trust or property owned by public administrative bodies, or companies owned by public administrative bodies or public foundations, or (3) public administrative bodies, including crimes against an individual who is acting on behalf of an administrative body (see question 11).

However, those hypotheses do not relate to crimes against the environment, which are the only crimes for which legal entities are potentially criminally liable in Brazil (see question 2).

14 Are ‘global’ settlements common in your country? What are the practical considerations?

Brazilian legislation has no clear arrangement regarding global settlements, including the possibility and requirements. Nevertheless, a significant number of global settlements have involved Brazilian companies (e.g., Embraer, Petrobras, Odebrecht/Braskem).

Technip Brasil and Flexibras, of the Technip group, signed a leniency agreement, which was the first to be negotiated entirely by the Federal Public Prosecution Office, the CGU and the Attorney General’s Office, as well as with the US authorities.

15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

Foreign authorities’ decisions do not determine Brazilian authorities’ decisions. There is independence and sovereignty for both investigations and decision-making, even on the same matter. However, a decision by a foreign authority that has assessed the same facts and evidence can be used by the Brazilian authorities as an additional argument for decision-making, since the evidence analysed abroad has complied with the conditions for lawfulness provided for in Brazilian criminal law, especially the rule of law.

Economic sanctions enforcement

16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

In terms of economic sanctions, the Head Minister of the CGU has signed 11 leniency agreements involving payment to the Treasury by sanctioned companies of more than 13 billion Brazilian reais (as at 20 August 2020), including fines and reimbursement of damages. Further, according to the Brazilian Transparency portal, at the federal level, Brazilian authorities have barred more than 14,000 companies (as at 20 August 2020) from entering into contracts with public administration authorities.

17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

The level of enforcement action has increased dramatically during the past decade. In the past, executives of large companies and politicians were rarely arrested. Currently, based only on the Federal Public Prosecutor’s website regarding Operation Car Wash in Paraná (updated in March 2020), recorded proceedings include around 1,350 search and seizure warrants, almost 300 arrests, 49 criminal co-operation agreements, 14 leniency agreements, and 4 billion Brazilian reais returned to the public treasury.

18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Brazil has signed several co-operation agreements with enforcement agencies in countries such as Chile, Switzerland and the United States. See also question 14.

19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Brazil has not enacted any blocking legislation. However, Article 17 of the Introductory Act to the Rules of Brazilian Law, sets forth: ‘The laws, acts and sentences of another country, as well as any declarations of will, will not be effective in Brazil when they offend national sovereignty, order and good morals.’ Depending on the nature of the foreign decision, its enforcement in Brazil may be challenged.

20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Brazil has not enacted any blocking legislation. Nevertheless, Brazilian Civil Code, in Article 15 of Law No. 13,655 (the Introductory Act to the Rules of Brazilian Law), provides for the following:

In Brazil, a sentence imposed abroad, which meets the following requirements, will be enforced: a) the sentence was delivered by a competent judge; b) the parties have been served or legally verified in absentia; c) res judicata applies in addition to the necessary formalities for execution in the place where it was given; d) the proceedings have been translated by an authorised interpreter; e) the sentence has been approved by the Federal Supreme Court.

Before an internal investigation

21 How do allegations of misconduct most often come to light in companies in your country?

Allegations of misconduct most often come to the attention of companies through whistleblowers, either in-house or external, investigations conducted by enforcement authorities or internal audits (often with the assistance of external auditors).

Information gathering

22 Does your country have a data protection regime?

The Data Protection Law was passed in August 2018 and is effective from 27 August 2020, with sanctions being allowed only after 3 May 2021.

The Law was inspired by the GDPR. It defines ‘personal data’ as data relating to an identified or identifiable individual and provides for principles such as transparency, purpose, data minimisation and accountability when processing activities take place. Data controllers are required to have a legal basis for processing personal data, and must implement security measures to prevent unauthorised access to or processing of personal data. It also regulates international personal data transfers.

Failure to comply with the law may result in application of warnings, fines of up to 2 per cent of the group’s net revenues in Brazil in the preceding year, suspension of processing activities and even a ban on processing data, among other things. There are also privacy principles and related rules established in the Civil Code, Consumer Defence Code, Internet Law and other pieces of legislation, all of which will coexist with the Data Protection Law once it is fully effective.

23 To the extent not dealt with above at question 9, how is the data protection regime enforced?

As indicated in question 9, intervention by law enforcement authorities has been limited mostly to cybersecurity failings involving breach or unauthorised processing of consumer-related personal data. To the extent that sanctions are imposed, these authorities apply the sanctions established in the Consumer Protection Code, not in the Data Protection Law.

More generally, there has been significant enforcement of privacy rights in connection with the use of a person’s image for commercial purposes and in the context of employment relationships. Enforcement, in these cases, is usually effected through individual claims for damages arising from the violation of privacy rights.

24 Are there any data protection issues that cause particular concern in internal investigations in your country?

There are many precedents in Brazil concerning an employee’s privacy rights in the workplace and in the context of an employment relationship. To this effect, privacy and data protection concerns may arise if a company fails to clearly communicate to employees its policies in connection with monitoring employees’ activities, technological resources, use of personal devices for employment-related activities, and so on.

25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

Interception of employees’ communications has been regulated through precedents of the labour courts in Brazil. The general rule is that employees should not have any expectation of privacy when they use resources offered by the employer (e.g., email account and technology devices such as notebooks and cell phones) for employment-related activities. This position is strengthened if the employer establishes clear policies on the monitoring of employees’ activities in the workplace and the use of company-provided resources.

The Constitution protects the right to privacy, especially in respect of devices owned by the employee. However, exceptions apply when the company provides the employee with a device or system, such as a cell phone, computer or simply an email or Skype account, to perform his or her duties. Whenever a company provides equipment as a work tool, the understanding is that it has the duty to supervise its accurate use, and thus the employee does not have the assumption of privacy. In this last situation, access to data by the company is permitted.

Dawn raids and search warrants

26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Recent major criminal investigations (e.g., Mensalão, Car Wash, Zelotes, Greenfield, and those relating to covid-19) show that search warrants and dawn raids have been the preferred mechanism for public authorities to collect evidence more quickly and effectively. Under Brazilian criminal law, the police must present a specific search and seizure warrant, duly authorised by the court, to a particular department of the company or for material pertaining to certain employees. General searches inside company premises are not allowed. If authorities exceed the limits of a search warrant, both the individuals and companies involved and affected by the improper collection of evidence can request that any seized documents be retracted and excluded from the case.

27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

Under Brazilian law, attorney–client communication is privileged and confidential. The definition of specific spaces within the legal department and the explicit identification of documents covered by privilege are ways to protect material from being improperly seized during a dawn raid.

28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

Under Brazilian criminal law, individuals who are suspected of involvement in committing an offence cannot be compelled to give testimony. These individuals also have the right against self-incrimination and there is no crime of perjury. Compelled testimonies regarding such individuals are illegal and cannot be used in criminal procedures.

Witnesses, on the other hand, are obliged to collaborate with an investigation. If witnesses do not comply with an order to attend a hearing, they can be sanctioned with a fine, can be coercively conducted to a police station or court, and be charged with the crime of disobedience.

Whistleblowing and employee rights

29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

Law No. 13,608/2018 establishes that any individual may report a crime to public authorities and may have their identity protected. There is no financial incentive offered to whistleblowers in Brazil.

In the corporate world, the Anti-Corruption Law regulates the requirements for a compliance programme, which should contain a proper whistleblower channel and policies regarding confidentiality and non-retaliation.

Although Law No. 9,807/1999, which instituted the Federal Programme for Assistance to Victims and Witnesses, provides for the protection of witnesses who have co-operated with investigations, it is Federal Law No. 13,608/2018 that definitely introduced the concept of whistleblowers to the Brazilian legal system and the importance of their co-operation. The Law provided guidelines for telephone services on receiving complaints and granting anonymity and rewards for information that contributes to the investigation of illegal conduct by private or public organisations.

Law No. 13,608/2018 was amended by Federal Law No. 13,964/2019 (Anti-crime Package) in respect of retaliation towards whistleblowers, such as arbitrary dismissal, unjustified alteration of functions and the imposition of sanctions. Any retaliation against whistleblowers will constitute a serious disciplinary offence. The agents of retaliatory conduct may be subject to dismissal from public service and, in addition, the whistleblower may be compensated twice for any material and moral damages.

30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Employment law in Brazil has undergone major changes, but it continues to be protective towards employees. As regards conduct within the scope of an investigation, it is recommended that employees be allowed to defend their actions and counter any accusations.

An investigation must adhere to the required levels of secrecy and discretion to avoid anything being revealed that might cause harm to employees.

31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

An employee involved in misconduct may be reprimanded or dismissed with cause. In either case, he or she has the right to apply for the matter to be addressed in court.

32 Can an employee be dismissed for refusing to participate in an internal investigation?

No.

Commencing an internal investigation

33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

This should be assessed case by case, taking into consideration the company and the complexity of the investigation to be undertaken. However, in general, it is deemed good practice to prepare a document that sets out a list of the matters that need to be clarified by the investigation and which mechanisms will be used to achieve those clarifications (e.g. gathering computer records and cell phone data, interviews and background checks), such as identifying the parties potentially involved in the alleged irregularities, any violations of the relevant legislation and which authority may have jurisdiction in the matter.

34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

Despite not having legal provisions in this sense, as soon as an irregularity is reported, companies must initiate an internal investigation to collect relevant evidence respecting its internal investigation protocols. The investigations should involve collection and protection of evidence; physical and electronic document analysis; independent research, such as background checks and audits; and interviews with key people.

Even while covid-19 restrictions continue, companies must not fail to investigate, especially in respect cases involving the public administration. With the increase in emergency public procurement, companies must be alert to occasional reports of corruption, which in Brazil have already begun to emerge and are being investigated by national authorities.

35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

A company should immediately involve its legal team (in-house, external or both) to identify the extent of the allegations, the potential risks, whether other authorities would also have jurisdiction, and which stakeholders should be informed.

The company must respond to the authority in a timely manner, be co-operative, transparent and provide all the information requested, in an accessible format. It is also very important to establish which documents are subject to the attorney–client privilege.

36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

The timing and quality of disclosure should be considered in each case or event. Therefore, the decision to publicly report the existence of an internal investigation or contact by law enforcement depends on several factors, including whether the company has shares that are traded publicly.

37 How are internal investigations viewed by local enforcement bodies in your country?

Internal investigations are currently encouraged by local law enforcement agencies and, in some cases, local authorities request the assistance of internal investigators to structure their cases.

Attorney–client privilege

38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Any communication between an attorney and a client in the context of a representation are protected in Brazil and are not subject to disclosure to third parties, with limited exceptions. Considering this main rule, an internal investigation may claim privilege over any investigative act conducted under the direction of a lawyer duly registered with the Brazilian Bar Association. To safeguard the protection of privilege, the involvement of individuals who are not lawyers must be as limited as possible.

39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Professional confidentiality is reflected in the Brazilian Constitution as a fundamental right. Within the legal system, privilege rules protect any communication between a lawyer and a client in the context of legal representation. The Brazilian Bar Association’s Code of Ethics and Discipline provides that an attorney has a duty to maintain confidentiality of all facts of which he or she has become aware while practising law, including activities of mediation, conciliation and arbitration. The rule makes no distinction between a company and an individual.

40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

The protection of confidentiality applies to the relationship between external attorneys and their clients, and between a company and its in-house counsel, as long as the communication relates to legal matters. Communications with an in-house counsel acting as a director or an officer of the company, not related to legal matters, are generally not protected.

41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?

All kinds of legal advice are protected equally under the duty of confidentiality. The attorney must maintain the confidentiality of facts learned during the practice of his or her profession under Article 7 of the Statute of the Attorney and Article 35 of the Code of Ethics and Discipline of the Brazilian Bar Association. The term ‘facts’ also includes information disclosed in the exercise of any typical legal activities, such as those described in Article 1 of Law No. 8.906: consulting, advising and legal management.

42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

Waiver of the attorney–client privilege may be requested by authorities as part of a plea agreement or a leniency agreement. Usually, at the beginning of settlement discussions, the authorities and the individual or company sign a non-disclosure agreement to protect the information that will be shared in the context of the negotiation. After the agreement is signed, a waiver may be included in the resolution.

43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

There is no specific regulation covering the extension of a waiver or the prohibition of a limited waiver. Note that legal proceedings in Brazil have a different level of secrecy and, in some instances, the docket case file may be deemed entirely confidential at the court’s discretion.

It is possible to waive privileges for certain communications but not others.

44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

As discussed in question 43, clients may claim limited waiver in Brazil and thus privilege may be claimed over information provided from another country.

45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Parties with a common interest may share privileged information in Brazil as long as lawyers duly represent them and they have authorised communication between counsel. Under Brazilian law, the concept of joint defence does not exist. However, attorney–client communications are protected by the broad confidentiality principle. In recent cases, courts have stated that the duty of confidentiality is extended to the client, but only to people who have a common interest in the facts being investigated, including potential co-defendants.

46 Can privilege be claimed over the assistance given by third parties to lawyers?

According to Provision 188/2018 (Articles 4 to 6) of the Brazilian Bar Association, a lawyer conducting an investigation can directly take all the investigative steps necessary to clarify the facts, in particular the collection of testimonies, research and obtaining data and information available from public or private agencies, determining the preparation of expert reports and examinations, and performing reconstructions, except in the event that a member of the judiciary has exclusive jurisdiction over the matter.

Witness interviews

47 Does your country permit the interviewing of witnesses as part of an internal investigation?

Provision 188/2018 in the Brazilian Bar Association provides for the defensive investigation conducted by lawyers in defence of their clients. Article 4 of this Provision authorises lawyers, when conducting defensive investigations, to directly take all investigative steps necessary to clarify the facts, especially at witness interviews. However, note that application of this Provision is restricted to the practice of law in the context of defensive investigations.

Further, via internal policies, companies may regulate the investigative steps, including interviews, but defence rights shall be granted to employees.

48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

Provided an attorney was involved in the process, privilege may be claimed. Pursuant to Article 5 of Provision 188/2018, during the time an investigation is being conducted, the lawyer must preserve the confidentiality of the information collected, and the dignity, privacy, intimacy and other individual rights and guarantees of the persons involved. Any eventual communication or publicity relating to the outcome of the investigation will require express authorisation from the company in question.

49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Brazilian legislation has no provision in this regard. Nevertheless, it is deemed advisable to indicate that the content of the interview is privileged and that the witness should regard the matter as confidential.

It is essential that the interviewer starts the interview by making it clear that the investigation is being conducted in the interests of the company. Therefore, confidentiality belongs with the company, which will be informed of the content of the interview to assist with the investigation.

Employment contracts are governed by the general principle of good faith, which imposes on the parties duties of loyalty, information and mutual respect.

50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

Typically, the lawyer conducting the investigation should have a list of questions and documents to be shown as evidence to a witness. Employees, if they so wish and at their request, may have their own legal representation at the interview.

In general, there are two types of interviews: overview and confrontational. Overview interviews can be conducted at any time during an investigation (usually at the beginning) and aim to provide elements to better prepare the investigation team to understand the facts being investigated.

Reporting to the authorities

51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Reporting misconduct is not mandatory in Brazil. There is even an established constitutional principle that establishes the right not to incriminate oneself.

However, if a company or individual wants to enter into a leniency agreement or plea agreement, co-operation is required. Companies interested in entering into a leniency agreement with the Brazilian authorities must collaborate to identify the others involved in the administrative infraction, when applicable, and to obtain information and documents that prove the infraction under investigation.

52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Prior to self-reporting, it is highly recommended to identify which authorities are likely to have jurisdiction over the matter and contact them all (although this is a difficult task to coordinate), to mitigate any risk of legal uncertainty in connection with a subsequent investigation and to avoid any lawsuits being initiated by other authorities on the basis of the information reported to a specific authority.

53 What are the practical steps you need to take to self-report to law enforcement in your country?

Self-reporting can be very complex, as more than one enforcement agency may have an interest or jurisdiction in any single case. First, the self-reporting entity should ensure that sufficient evidence has been obtained (usually via an internal investigation) regarding facts that may still be unknown by the authorities or about which there is a lack of evidence. The entity should also ensure that it has completely ceased to be involved in the harmful act. It should then identify, based on the facts, which are the relevant competent authorities. It may be necessary for the entity to conduct an assessment of the self-reporting requirements for each authority. Initial contacts may be made with authorities to provide preliminary information, by executing of a non-disclosure agreement. It is important for a self-reporting entity to be supported by experienced lawyers during these negotiations.

Responding to the authorities

54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

In cases where a company has already launched an internal investigation and may be expecting contact from the relevant authorities, the counsel conducting the investigation should recommend the best strategy. When a notice or subpoena is issued unexpectedly, the company should immediately retain an experienced counsel and discuss the best approach.

Some authorities are open to being approached by companies and may agree to initiate discussions on a possible settlement. Other authorities are more restricted and may not agree to provide any information to companies. In the latter case, companies may claim access to investigative proceedings in court.

55 Are ongoing authority investigations subject to challenge before the courts?

Any individual or company under investigation may challenge proceedings in a court if any rights are violated. The challenge may be broad, such as to terminate the investigation, or limited, with respect to a specific act or piece of evidence.

56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

Brazilian and foreign authorities are in constant communication and have shared relevant information in many cases. Thus, it would be advisable to retain counsel in all countries that may be involved in the enforcement actions. Counsel should decide the best strategy in each case and, if possible, should initiate communications with all authorities at the same time. It is also recommended to maintain transparency and isonomic relationships with all the authorities.

57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

In general, a company must search for and produce any material requested by the authorities. If the material or documents are located in a country with restricted privacy laws, the company must retain local counsel and report the legal conflict to the authorities. In certain cases, to avoid local claims, the foreign authorities should request production of the document directly to a local authority and not to the company.

58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

As has been seen during the Operation Car Wash investigations, the Brazilian authorities have shared and received information from several authorities, including in the United States and Switzerland. Brazil has signed bilateral co-operation agreements with several other countries, including Chile and Switzerland, and has ratified international agreements such as the Palermo Protocols and the US Foreign Account Tax Compliance Act.

59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

In December 2019, the Plenary of the Supreme Federal Court approved a treatise in which the sharing of taxpayers’ banking and tax data obtained by the Federal Revenue and the Financial Intelligence Unit with the Public Prosecution Office and the police authorities was validated without the need for prior authorisation from the judiciary.

60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

The scope for Brazilian authorities to request documents is limited to the jurisdiction of Brazil. In other words, a Brazilian authority would not be competent to request a document from a company with its headquarters in another country or its foreign subsidiary, unless it has made a formal request to the foreign authority, which would have to accept the request and make the formal request for the foreign company.

If the production of a certain document or piece of evidence encounters any restriction or impediment in the legislation of the other country, the company may refuse to provide it, on the grounds that the production of the document or evidence would constitute a violation of the legislation of the other country.

61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

According to Brazil’s Data Protection Law, companies and individuals may only retain information about other individuals or companies if supported by particular requirements. It is not yet clear how the law will be implemented.

There is existing legislation that regulates international law and requires approval from the Superior Court of Justice for the enforcement of international decisions or subpoenas. This type of decision or subpoena will not be deemed valid and enforceable if it violates Brazilian sovereignty.

62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

There is no particular risk with voluntary production. Considering that co-operation may result in a reduction of sanctions in the context of the Anti-Corruption Law, companies may consider voluntary disclosure. Once produced (voluntarily or compelled), the material may be discoverable if there is no requirement to maintain secrecy in the case. There is no particular confidentiality in the production of material, but a company may request secrecy in respect of all material or business-related information. In a voluntary production under a leniency agreement, there are confidentiality rules, and evidence has to be returned to the company if a settlement is not reached.

Prosecution and penalties

63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Following conviction, penalties that may be applied to individuals (including company officers and directors) are imprisonment, restriction of rights and fines.

A prison sentence may be replaced by restriction of rights if the following requirements are fulfilled: (1) the term of imprisonment is less than four years and no violence or serious threat was used (but note that in the case of negligent conduct, there is no time limit); (2) the convicted person has not committed the same wilful crime previously (specific recidivism prevents this substitution); and (3) the offender’s personal characteristics and behaviour should indicate that a substitution of penalty is adequate.

Pursuant to the Criminal Code, restriction of rights penalties are:

• payment to the victim or to charitable causes;
• confiscation of assets and valuables;
• attending conferences or courses, or participating in educational activity at a prison facility, for five hours at the weekend;
• community services; and
• temporary suspension of certain rights, such as holding a public or elective position, joining a profession that requires a special licence or authorisation from public agencies, visiting certain locations, or applying for public competitions, evaluations or exams.

As stated previously, the Anti-Corruption Law provides the strict liability of companies for corrupt acts committed by their partners, employees, representatives and third parties. Under this Law, legal entities can be subject to administrative and judicial penalties.

Other types of restriction of rights penalties can be applied in specific instances, such as for crimes against consumers (under Federal Law No. 8,078/1990) or environmental crimes (under Federal Law No. 9,605/1998).

Legal entities are subject to the following criminal penalties:

• fine;
• community service;
• partial or total suspension of activities;
• temporary restrictions on establishments, plants, projects or activities; and
• disqualification from contracting with government entities, and from obtaining public subsidies, grants or donations for up to 10 years (Federal Law No. 9,605/1998, Article 22).

64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

From a criminal perspective, settlement in another country does not prevent a company (or its directors) being held criminally liable in Brazil. In view of the co-operation between authorities, information presented to a foreign authority can potentially be shared with Brazilian authorities and, therefore, expose the company to civil and administrative liability and its directors to civil and criminal liability in Brazil. Therefore, if co-operation with another country is envisioned, the company may also consider the benefit of a simultaneous settlement in Brazil.

65 What do the authorities in your country take into account when fixing penalties?

Brazilian courts should follow three steps to determine the penalties that will be imposed on an individual. In the first instance, the court should consider:

• the individual’s culpability, criminal background and social behaviour;
• the motivation for the crime, the circumstances and the consequences; and
• the conduct of the victim (i.e., any contribution to, or facilitation of, the crime).

Second, the severity of penalties should be increased in consideration of:

• recidivism by the offender;
• the motivation for the crime;
• how the crime was committed;
• who the victim is;
• the behaviour of the offender during the crime;
• the context in which the crime was committed; and
• the leadership of the offender.

Conversely, penalties may be reduced in consideration of:

• admission of guilt by the offender;
• the offender’s age;
• the motivation for the crime; and
• any attempt by the offender to mitigate the consequences of the crime.

As a third step, the court should consider general or specific criteria – depending on the crime in question – to increase or decrease penalties (e.g., attempted use of a firearm).

In relation to fines, criminal law prescribes certain parameters. In addition, the financial situation of the offender should be considered in applying an appropriate penalty.

The Anti-Corruption Law provides aspects that shall be taken in consideration when applying sanctions to legal entities:

• the seriousness of the infraction;
• the advantage obtained or intended by the offender, or offenders;
• the fulfilment or not of the infringement;
• the degree of injury or the risk of injury;
• the negative effect produced by the infringement;
• the economic status of the legal entity;
• the level of co-operation by the legal entity in the investigation of violations;
• the existence of internal mechanisms and procedures for integrity, auditing and incentive to report irregularities and the effective application of codes of ethics and conduct within the scope of the legal entity; and
• the value of the contracts maintained by the legal entity with the injured public body or entity.

Resolution and settlements short of trial

66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Brazilian criminal law allows individuals and companies to benefit from a non-criminal prosecution agreement. NPAs are available to companies only in respect of environmental crimes, because, in Brazil, legal entities can only be criminally liable for this kind of crime.

NPAs can be proposed by the Public Prosecutor in relation to crimes for which the minimum penalty is imprisonment for less than four years. As part of the NPA, the beneficiary must repair the damage caused as result of the offence, carry out community service and pay a fine. The Public Prosecutor may also impose other obligations on the company.

The company is entitled to this benefit if it is not a recidivist and has not benefited from an NPA in the past five years. Once the conditions are accepted by the company, the agreement will be ratified by a judge.

Under the Anti-Corruption Law, companies may enter into a leniency agreement to administratively resolve a case of corruption.

In Brazil, an instrument called a conditional suspension of the criminal lawsuit is similar to a deferred prosecution agreement. When criminal charges for offences with a penalty of imprisonment for up to one year are offered, the Public Prosecutor may offer the defendant a conditional suspension of the criminal lawsuit. The defendant must not be a recidivist, must not be involved in a different criminal lawsuit and must agree to probation for between two and four years. During this period of probation, the defendant must repair the damage caused by the crime, can be forbidden to attend certain places, will only be allowed to leave the city where he or she lives with previous judicial authorisation, and must appear before the court once a month.

67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Reporting restrictions or anonymity for corporates are determined in each leniency agreement to ensure the effectiveness of the collaboration and the useful outcome of the lawsuit. In general, to ensure fairness in these proceedings, a proposed leniency agreement will not be announced to the public until after the agreement is effective or after the district attorney’s office presses charges against the defendants.

68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Companies should retain experts to assess which authorities could have jurisdiction over the facts and try to negotiate a simultaneous settlement with all the relevant enforcement agencies.

69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

There is no legal provision regulating the use of external monitors, although this tool is now being used in Brazil, such as in the Odebrecht case. In 2019, TechnipFMC signed an agreement with the authorities, with provision for monitoring of compliance by members of the Federal Comptroller General.

70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Third parties may file an indemnity or contractual judicial claim and a court or authority may decide to provide access to third parties.

In the event of a claim for indemnity by a minority shareholder, there are some precedents of court decisions denying this right on the grounds that the action against the controlling shareholder must be promoted by the company, and that the minority shareholder cannot claim against the company for indirect losses, since the individual action is only applicable in the case of direct loss.

Regarding requests for documents and information about agreements, companies may claim the right of attorney–client privilege to refuse to supply the same to shareholders, as well as in view of the confidentiality and secrecy of the evidence produced, except in cases where it is possible to prepare a summary report in which the main issues are dealt with in the agreements and are public knowledge.

Publicity and reputational issues

71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

Pursuant to criminal procedure law, a police investigation is generally public. However, an investigation may be conducted in secret when it is necessary for the police to ensure the effectiveness of the investigation or to protect the identity of a suspect or victim. Individuals under investigation and their attorneys are entitled to have access to the records of the investigation, except any measures that are still being conducted (e.g., searches and seizures that are still being prepared or ongoing wiretapping). Denying a lawyer or an individual under investigation access to the investigation files is a crime in Brazil.

Criminal lawsuits are also public, unless secrecy is necessary to protect the privacy or identity of the defendant or victim.

72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

It is common for larger companies to use external public relations companies, and publicly traded companies make use of their internal investor relations departments. These are the most common options for handling external communications.

73 How is publicity managed when there are ongoing related proceedings?

Administrative accountability procedures (known as PARs) made by the CGU publicise the name of a company that is subject to a sanction. Once a company is sanctioned, that decision is also made public.

Further, note that information about several confidential cases in Brazil has been leaked.

Duty to the market

74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

This should be assessed in each case, but is mainly dependent on whether the matter involves a publicly traded company, in which case, the company has a duty to disclose material information regarding its business and finances as they relate to the settlement.

Anticipated developments

75 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

There is an increasing move by the authorities to establish minimum parameters for evaluating compliance programmes in the context of enforcement of the Anti-Corruption Law. The CGU is expected to release new guidelines on compliance programmes and guidance for its members to negotiate leniency agreements. For this purpose, the CGU has hired specialist Hui Chen (formerly of the US Department of Justice).

The aim of Bill of Law 1588/2020 (originally 435/2016 at the Senate) is to regulate the certification of compliance programmes by external validated certifying entities as a condition of entitlement to the reduction of penalties defined under the Anti-Corruption Law. This potential change is creating a lot of debate, as it has certain gaps and could also result in fostering compliance programmes that only look good on paper.

Footnotes