The 28th Private Law Chamber of the São Paulo Court of Justice (TJSP) ordered Boa Vista Serviços S.A. to pay R$ 5,000.00 in moral damages to a consumer for the unlawful sharing of his personal data, including phone number, address, and voter registration number. The ruling, authored by Judge Michel Chakur Farah, overturned the first-instance decision and also ordered the immediate deletion of the improperly shared information.
The dispute centered on the legality of data processing for credit protection purposes, as provided for under Article 7, item X, of Brazil's General Data Protection Law (LGPD). However, the Court found that the shared data was not strictly tied to credit risk analysis, as required by Article 3, paragraph 3, item I, of the Positive Credit Registry Law (Law No. 12,414/2011). The ruling noted that disclosing personal information without the data subject's authorization constitutes a violation of the LGPD, exposing the consumer to unnecessary risks and distress.
In addition to the damages, the company was given ten days to delete the data, subject to a daily fine of R$ 200, capped at 20 days. The Court reinforced the strict liability of data controllers under Article 42 of the LGPD, emphasizing that unlawful or excessive data sharing, even when it does not involve sensitive data, violates the security and privacy of data subjects.
The ruling also emphasized the need for careful judgment in determining the amount of damages, avoiding both impunity and unjust enrichment, and setting an amount that both compensates the harm and discourages similar practices in the future.
TJSP AC n. 1002097-72.2024.8.26.0047
This post was summarized from the original decision using ChatGPT version 4o, with human review.