Other commenter here. The text says that any autority (autoridade policial ou administrativa -> police force or administrative power) may require that the metadata be recorded for a period of time , but access to this metadata needs the judges order.

For example, if the cops starts investigating John Doe they may ask the service provider to keep metadata for a fixed period of time, stated on the Marco Civil (six months IIRC). But access to this metadata can only be authorized by a judge.

Edit: Reread the Marco civil an refreshed my memory. What I said is not entirely correct. All metadata is kept by default and needs a court order to be accessed. What authorities may ask without a court order is for the service provider to keep the metadata for a time longer than specified on the Marco civil.

Also, as I said on my previous comment, the intention of the bill was that only metadata was recorded, but the term "registros de conexão -> connections log" is vague enough to be interpreted in other ways :(