Judge applies LGPD (Brazilian General Data Protection Law) and condemns construction company that failed to protect client data.

Sharing consumer data with companies unrelated to the contractual relationship violates provisions of the General Data Protection Law — LGPD ( Law 13.709/19 ) —, as well as rights enshrined in the Constitution itself, such as honor, privacy, informational self-determination, and the inviolability of intimacy, generating the duty to compensate.

The understanding comes from Judge Tonia Yuka Koroku, of the 13th Civil Court of São Paulo. It is the first known decision in São Paulo to make use of the LGPD (Brazilian General Data Protection Law). In the ruling, issued this Monday (September 29th), the judge ordered Cyrela, a real estate company, to pay R$ 10,000 in damages to a client whose personal information was sent to other companies.

The author purchased an apartment in November 2018. In the same year, he began to be harassed by financial institutions and interior design firms, who cited his recent purchase with the defendant.

"'Partners' [of Cyrela] obtained the author's data so that they could provide him with services unrelated to those provided by the defendant itself [...] Specifically aware of the development in relation to which the author acquired an autonomous unit. Including proposals for payment of the property price through financing or consortium and the purchase and installation of custom-made furniture for the property," the decision states.

The judge states that, in addition to the LGPD (Brazilian General Data Protection Law), the defendant violated the Consumer Protection Code and provisions of the Federal Constitution, including those that advocate respect for dignity (Article 1, III); the construction of a free, just and supportive society (Article 3, I); and the promotion of the well-being of all, without prejudice (Article 3, IV).

"Article 5 of the Brazilian Constitution lists several fundamental rights that must be guaranteed and protected by the State, as well as observed by individuals in their relationships, which does not even require mediation through ordinary legislation. These fundamental rights include honor, name, image, privacy, intimacy, and freedom, which are complemented by the treatment given to them by sub-constitutional norms," states the judge.

According to lawyer Mario Filipe Cavalcanti de Souza Santos, who acted in the case defending the consumer, Cyrela stated that it had no responsibility for the data breach and that the lawsuit had been filed so that the plaintiff could "gain fame" at the expense of its brand's reputation. Therefore, it requested that the plaintiff be ordered to pay damages for moral harm.

The judge, however, dismissed the counterclaim, considering that any potential damage to the defendant's reputation stems from its own conduct. The plaintiff's claims were deemed entirely justified. Thus, Cyrela was found liable in both the main action and the counterclaim.

Data protection

Speaking to ConJur, the lawyer stated that part of the market and legal sector actors understand that rights related to privacy and data protection only came into existence with the LGPD (Law 13.709/18), which only recently came into effect.

He says, however, that the legislation merely brought together a series of regulations that have been present in the Brazilian legal system for a long time.

"In reality, the 1988 Constitution enshrines this protection in Article 5. In 2011, the Positive Credit Registry Law details these regulations. The Brazilian Internet Bill of Rights, from 2014, was Brazil's pioneering legislation on the subject, recognized worldwide. These laws already contain provisions that prevent the inappropriate processing of data," he states.

According to him, before the LGPD (Brazilian General Data Protection Law), "there were some actions based on the Consumer Protection Code, which has regulations on defects in the provision of services." "Often people asked for the restoration of services, for example. What we did was file the first lawsuit entirely focused on data breaches, requesting moral damages due to this breach, based on the aforementioned legislation and the LGPD."

Source: Conjur