Court’s ruling rejected request for compensation presented by a power utility consumer based on Brazilian version of GDPR
03/16/2023
/i.s3.glbimg.com/v1/AUTH_37554604729d4b2f9f3eb9ad8a691345/internal_photos/bs/2023/3/K/x6dNaBS7ySD8aGPncdSA/16leg-100-egpd-e1-img01.jpg)
Thiago Sombra — Foto: Divulgação
The Superior Court of Justice (STJ) has ruled for the first time that the leakage of ordinary personal data — such as name, ID, address, date of birth, and telephone number — without proof of the damage caused does not generate moral damages after the General Data Protection Law (LGPD) — Law No. 13,709, 2018 — came into force.
The second panel of judges unanimously denied R$15,000 in compensation to a consumer who filed a lawsuit against power utility Eletropaulo (now Enel) for the alleged leakage of her data.
In the sentence, they also understood that the list of the LGPD on what sensitive personal data is exhaustive, and therefore the leak of ordinary data does not give rise to compensation — unless there is proof of damage.
The ruling is important for companies because there has been an increase in litigation following the enactment of the LGPD, according to Thiago Sombra, the lawyer who advised Enel in the case, a specialist in data protection and technology at Mattos Filho Advogados.
The number of lawsuits involving the enforcement of the LGPD in the country grew to about 120 between 2020 and 2022 from less than 20, an increase of more than 500%, according to a study by Mattos Filho. The analysis only considered decisions of a civil nature, focusing on the State Courts of Justice, the STJ, and the Federal Supreme Court (STF). In cases of conviction for moral damages, the amount established ranged from R$2,000 to R$20,000.
For Mr. Sombra, this decision is expected to discourage new lawsuits, especially class actions, that seek moral damages without any evidence of harm simply because a data leak happened. “The mere occurrence of a leak is not enough to justify a claim for moral damages,” he said.
In this case, the consumer alleged that the utility inappropriately leaked and disclosed her personal information, including full name, ID, gender, date of birth, age, landline phone, mobile phone number, and address, as well as data from the power supply contract, installed load, estimated consumption, type of installation, and meter reading. As a result, she demanded compensation for moral damages.
The trial court rejected the claim. She appealed to the Court of Justice of São Paulo (TJ-SP), which ordered Eletropaulo to pay compensation for moral damages of R$5,000, on the grounds that it was the personal data of an elderly person. The company then appealed to the STJ.
The utility claimed that the data had been leaked by third parties, out of the business relationship, and that the appellate court was wrong to classify this information as sensitive, under Article 5, item II, of the LGPD — “since these would be basic qualifiers of any person, many of which are provided on a routine basis by individuals in the most varied and simple daily operations of civil life.”
According to the rapporteur, judge Francisco Falcão, Article 5, item II, of the LGPD expressly states which data may be considered sensitive and, under this condition, require different treatment, provided for in specific articles. “Data of a general nature, personal but not intimate, capable only of identifying the person, cannot be classified as sensitive,” he said.
He said that the data leaked in the case are those that are provided in any registration, including websites consulted on a daily basis, “therefore not covered by secrecy, and knowledge by third parties in no way violates the right to privacy of the defendant.”
For the judge, the leak of personal data, “despite being an undesirable failure in the treatment of data of persons by legal entities, does not have the power, by itself, to generate compensable moral damage.” According to Mr. Falcão, moral damages are not presumed “and the owner of the data must prove any damage resulting from the exposure of such information.”
The decision was made public last Friday. The decision can still be appealed to the STJ Section, but it will be difficult because the consumer’s defense will have to present a divergent decision from the 1st Panel.
The consumer’s lawyer in the case, Luís Eduardo Borges da Silva, said he is still evaluating the possibility of an appeal. “It is the first time that the matter is before the Superior Court of Justice and, above all, I believe that future decisions will be improved,” he said.
For him, the LGPD cannot be enforced or interpreted in isolation. In the specific case, he said that there was a flagrant violation of the Consumer Protection Code, in the case of Article 14, which states that the service provider is liable, regardless of fault, for repairing the damage caused to consumers.
Lawyer Daniel Becker, a partner in the Data Protection and Dispute Resolution practice at BBL Advogados, said that the STJ’s ruling resolves a debate about the exhaustive or exemplary nature of the list of sensitive data in the LGPD.
If the list is considered illustrative, other leaked data could also be considered sensitive, such as a criminal record certificate or data included in a resume, such as a name, address, application for employment, or even payroll. In the case of data considered sensitive, he said, moral harm could be presumed.
“The decision does a good job of delimiting and providing legal certainty that only the data mentioned can be considered sensitive,” Mr. Becker said. This confirms the prevailing doctrine and the position of some state courts. For him, the decision is important because it shows that the LGPD is under judicial scrutiny.
For Paulo Vidigal, a partner at Prado Vidigal Advogados, a law firm specializing in digital law, privacy, and data protection, the decision shows that there will be no room for the installation of the so-called industry of moral damages in matters of privacy and data protection. “This is something very positive because these leaks, however undesirable, may continue to occur,” he said.
According to Mr. Vidigal, it is necessary to demand that organizations actually have a robust information protection program and use best practices. “But you can’t let people make money from unjustified lawsuits where there’s no proven harm,” he said.
Enel declined to comment.
*Por Adriana Aguiar — São Paulo
Source: Valor International