Tatiane Bagagí Faria
Lawyer at Marcos Martins Advogados
The General Data Protection Law (LGPD) was sanctioned in September 2020 and will come into force nationwide, except for its sanctions, which will only come into force in August/2021, as determined by Law 14.010/2020.
The aim of the LGPD is to unify the rules on the processing and protection of customers’ and users’ personal and sensitive data by public and private companies, which will have to adapt to the new rules, especially with regard to data storage, processing and protection. The primary role of the legislation is toguarantee the right to privacy[1] of an individual’s personal data, which is nothing more than the set of distinct pieces of information that can lead to the identification of a specific person. On a secondary level, the LGPD aims to establish rules for companies that store and collect data and also to foster technological development in an increasingly digital society.
Even before the law came into force, many cases came before the courts seeking judicial orders to inhibit the practice of improper sharing of personal data by companies and agencies, as well as civil reparation for damage to personality caused by the disclosure of sensitive information without the user’s/customer’s authorization.
Now, with the law in full force, the Judiciary will now rely on its principles and provisions, as well as constitutional norms, to analyze and assess the issue in question. In this sense, in September of this year, the 13th Civil Court of the Central Civil Court of the District of São Paulo judged an Action for Obligation to Do c.c. Compensation for Moral Damages due to inadequate treatment of data consisting of unauthorized disclosure, handing down a sentence based on the General Data Protection Law.
In the case at hand, the Plaintiff alleges that he signed a real estate development contract with a certain construction company, which shared, without authorization, personal and sensitive data, presented exclusively for the conclusion of the contract, to third parties outside the negotiation, who began to constantly harass him to sell products and services of any kind.
In the lawsuit, he sought injunctive relief for the construction company to refrain from providing and sharing the contractor’s personal data to third parties, under penalty of a daily fine, as well as requesting that the lawsuit be upheld to determine the elimination of all of the Plaintiff’s personal, financial, banking and sensitive data used for purposes not provided for in the contract, as well as condemnation of moral damages in the amount of R$ 60,000.00 (sixty thousand reais).
In her judgment, the judge in the case upheld the plaintiff’s claims to confirm the provisional injunction initially granted, in order to:
a) order the construction company to refrain from passing on or granting to third parties, free of charge or for a fee, personal, financial or sensitive data held by the Plaintiff, under penalty of a fine of R$300.00 (three hundred reais) per undue contact;
b) order the company to pay compensation for moral damage in the amount of R$10,000.00 (ten thousand reais).
As a reason for her decision, the Magistrate invoked the precepts of the General Data Protection Law, asserting that the new legislation acts concurrently with consumer legislation, especially in protecting and guaranteeing the fundamental principles of the Republic expressed in the Federal Constitution of 1988 with regard to respect for human dignity (art. 1, III, CF/88), the construction of a free, just and supportive society (art. 3, I, CF/88) and the promotion of the good of all without prejudice (art. 3, IV, CF/88).
Not enough, he invoked, in particular, the provisions of the LGPD that deal with personal and sensitive data and the specific purpose of the holder when sharing his information with the construction company, making it clear that there was a misuse of purpose from the moment the company shared the customer’s data with third parties outside the contract, thus characterizing strict liability for the unlawful act committed.
Thus, the Judiciary has adapted to the legislative changes on this specific issue and has acted to grant the necessary effectiveness to ensure compliance with the legal provisions contained in the legislation, with the aim of protecting the right to personality, as well as the sensitive data and information of citizens , while also seeking to curb the undue practice of companies and bodies sharing information improperly, which can cause various damages and losses to the holders of the right.
Marcos Martins Advogados is aware of this issue and is prepared to provide qualified legal advice to its clients.
Have any questions? Talk to our lawyers and receive guidance.
[1] Art. 5, item X, of the Federal Constitution: the privacy, private life, honor and image of persons are inviolable, with the right to compensation for material or moral damage resulting from their violation assured;
