Court Convicts Boa Vista for Unauthorized Sale of Personal Data for Marketing

The São Paulo Court of Justice (TJSP) convicted Boa Vista Serviços S.A. for selling a consumer's personal data without proper consent, in violation of Brazil's General Data Protection Law (LGPD). The plaintiff alleged that the company sold information such as estimated income, address, and phone numbers without authorization, allowing third parties to access this data for marketing purposes rather than credit protection. The court found the company's conduct unlawful, constituting an abusive use of consumer data.

In its ruling, the court concluded that Boa Vista disregarded the need to obtain prior consumer consent before sharing their information with third parties. The data was sold through services offered by the company, which used it for marketing strategies — allowing client companies to acquire new customers. The court emphasized that even though the commercialized data was not classified as sensitive, it was still personal information protected by law, requiring proper handling to prevent misuse and abuse.

The ruling also noted that Boa Vista not only disclosed the data but profited from selling it, which demonstrated the seriousness of the conduct. As a result, the court recognized a violation of the plaintiff's personality rights and determined that moral damages existed regardless of whether concrete harm could be proven. Based on the principle of full consumer compensation, the company was ordered to pay R$5,000.00 in damages to the plaintiff.

In addition to the damages, Boa Vista was ordered to immediately cease disclosing and selling the consumer's data for any purpose other than credit protection. Non-compliance would result in a fine of R$1,000.00 per violation. The ruling also emphasized that civil liability under the LGPD is not limited to the violation of sensitive data but covers any irregular processing of personal data, including unauthorized sale.

The case drew attention for involving not only the protection of an individual right, but also a potential harm to the collective rights of consumers. For this reason, the court ordered that the Public Prosecutor's Office be notified of the case to assess the need for additional measures in light of the data protection law violations.

TJ/SP AC - 1008865-92.2024.8.26.0506

This post was summarized from the original ruling using ChatGPT version 4o, with human review.