The São Paulo Court of Justice ruled that the company Boa Vista Serviços must pay R$ 5,000.00 in moral damages after selling a consumer's personal data without prior authorization. The 28th Chamber of Private Law partially reversed the lower court's decision, which had dismissed the claim, recognizing a violation of the consumer's data protection rights.
The case involved the unauthorized sale of a consumer's personal information, including estimated income, home address, and phone numbers, for marketing and commercial prospecting purposes. The court found that the company used this information through its "Data Plus" product, a data enrichment solution designed for marketing campaigns — particularly for credit and debt collection — allowing paying clients to access this data.
The ruling was based on LGPD (Brazil's General Data Protection Law), establishing that even data not classified as sensitive — such as income, address, and phone number — qualifies as personal data and is therefore protected by the law. The reporting judge emphasized that the strict liability rules set forth in the LGPD are not limited to sensitive personal data but extend to all categories of personal data, as provided in Article 42 of the law.
The court also granted injunctive relief, prohibiting the company from disclosing, sharing, or allowing access to the consumer's personal information for purposes other than credit protection, subject to a fine of R$ 1,000.00 per violation. The decision recognized the existence of presumed moral damages (in re ipsa), waiving the need to prove specific harm, given that the unauthorized sale of personal data constitutes a violation of personality rights and an offense to consumer dignity.
This post was summarized from the original court decision using AI, with human review.
TJSP/AC No. 1011141-96.2024.8.26.0506.