In a landmark decision, Brazil's Superior Court of Justice (STJ) recognized that the leaking of personal banking data that enables fraud against a consumer, in and of itself, gives rise to a right to compensation for presumed moral damages. In the case at hand, a consumer fell victim to a fake payment slip (boleto) scam after criminals obtained precise details about her financing contract — including the amount, number of installments, and vehicle license plate — data that should have been kept confidential by the financial institution. The ruling overturned a prior decision that had denied moral damages, requiring the bank to reimburse only material losses.
The Court emphasized that the sense of insecurity experienced by the consumer upon realizing that her personal data was improperly made available to third parties goes beyond mere inconvenience. Upon learning that her confidential information is in the hands of criminals, the victim must live with the fear of new attacks and the instability that comes from losing control over her own data. The ruling states that "storing data inadequately, allowing third parties to access confidential information and cause harm to the consumer, constitutes a defect in service provision (art. 14 of the Consumer Protection Code and art. 44 of the LGPD)".
According to the STJ, moral damages arise precisely from this sense of insecurity, as the breach affects not only financial assets but also personality rights such as privacy and trust in the institution responsible for handling personal information. Therefore, no additional proof of harm or embarrassment is required for the right to compensation to be recognized.
The ruling confirms the strict liability of financial institutions in ensuring the protection of their customers' data, and establishes that the mere use of confidential banking data in a fraud already constitutes presumed moral damage — particularly due to the psychological distress and sense of vulnerability suffered by the victim.
This post was summarized from the original ruling with the use of AI, with human review.
REsp n. 2187854/SP