The Court of Justice of Paraná (TJPR) overturned a first-instance ruling, clearing Mercado Pago of liability in a fraud case. The 6th Civil Chamber concluded that no service failure occurred on the company's part, reversing the initial judgment that had ordered Mercado Pago to compensate a consumer who fell victim to a scam.

The case involved a consumer who was contacted via WhatsApp by an individual posing as a Mercado Pago employee. The scammer offered an increase in her credit limit, leading the victim to share personal and banking information. As a result, the consumer made transfers and even took out a fraudulent loan.

The court found that the fraud occurred due to the exclusive fault of the victim and third parties — a situation legally classified as an external fortuitous event (fortuito externo). This means the incident fell outside the sphere of control and responsibility of Mercado Pago. The ruling noted that no evidence was found of a data breach by the company or failures in its security systems. A key factor in the decision was the fact that Mercado Pago acted promptly upon being notified of the incident by blocking the user's account. However, the fraudulent transactions had already taken place before that notification, limiting the company's ability to prevent the loss.

Regarding the General Data Protection Law (LGPD) aspects addressed in the ruling, the court examined the alleged leak of personal data. The court found that the mere prior knowledge of the plaintiff's name and CPF by the fraudsters does not, in itself, constitute a data breach by the company. The decision noted that this type of information — common personal data, not sensitive data — is frequently shared in everyday registrations. Furthermore, the ruling emphasized that liability for a data breach under the LGPD depends on effective proof of its occurrence and a causal link to the harm suffered by the data subject, neither of which was established in this case.

TJPR/AC n. 0001823-10.2023.8.16.0025

This post was summarized from the original ruling using ChatGPT version 4o, with human review.