The 4th Special Court Panel of the Court of Justice of Paraná examined a case involving a violation of the General Data Protection Law (LGPD) by the State University of Western Paraná (Unioeste). The institution was ordered to pay R$ 10,000 in moral damages after publicly disclosing, without authorization, a medical report containing sensitive information related to the plaintiff's autism spectrum disorder on its website.
The court recognized that Unioeste infringed upon the fundamental rights to privacy and personal data protection, guaranteed by the Federal Constitution and the LGPD. The public disclosure of the medical report without consent was deemed a serious violation, particularly given that it involved sensitive data that can lead to social discrimination. The ruling emphasized that public administration entities are also subject to the LGPD rules governing the protection and proper handling of personal data.
The judgment treated the data breach as moral damages in re ipsa — that is, presumed from the severity of the situation itself, with no need for additional proof of harm. The amount of compensation was set taking into account the extent of the damage and the educational purpose of the ruling, aiming to deter future violations of this nature.
Additionally, the court reaffirmed that personal data protection is a fundamental right and that public institutions have a duty to ensure the confidentiality and security of information under their responsibility.
This post was summarized from the original ruling using ChatGPT version 4.0, with human review.
TJ-PR/RI n. 0002988-59.2022.8.16.0209