By: Leonardo Neri
Court of Justice of the State of São Paulo containing LGPD
We have collected some court decisions from the Court of Justice of the State of São Paulo containing grounds on the LGPD. They stand out:
The 34th Chamber of Private Law exempted Eletropaulo from indemnifying a customer for data leakage. The judge emphasized that the company was not to be blamed for the episode, which occurred due to the hackers´ action.
In another decision involving Eletropaulo, the 29th Chamber of Private Law denied a request for compensation for moral damages made by a customer who also had his data leaked. “In cases such as this, in this sense, in addition to finding the irregularity in the user data processing, it is necessary for the intended compensation to prove, for example, the actual use of such information by third parties, or at least the minimum specification of the consequences resulting from the misuse, which undoubtedly did not happen in this case,” he said.
The 4th Chamber of Private Law ordered two construction companies to block the personal data of a customer. The consumer claimed that after signing a contract with the defendants, began receiving calls and messages from third parties outside the business relationship, offering services for the property purchased. The rapporteur also dismissed the argument of the builders that the LGPD would not apply to the case, since the contract with the customer was signed in 2019 and the standard only came into force in 2021: “These rights did not come into existence from the LGPD, on the contrary: they gave rise to the specific law, because they had been present for a long time in our legal system.”
An educational services company was convicted by the 30th Chamber of Private Law after an employee passed the phone number of a customer to another person. The student, in addition to not having authorized the number, still began to be harassed by WhatsApp messages. The rapporteur dismissed the thesis of passive illegitimacy raised by the company.
According to her, the fact that generated the damage was the transfer of the plaintiff’s cell phone by a defendant representative to a third party. “This breach of the duty of data protection attracts to itself the responsibility for moral damages (LGPD, art. 42),” she pointed out.
The 7th Chamber of Private Law denied a request for “right to be forgotten” to a man convicted of copyright infringement to have his name and image deleted from news published on the Internet in 2014.
The 31st Chamber of Private Law determined that a condominium administrator must provide the personal data of the residents (such as full name, e-mail and phone number) to a group of unit owners who intend to call an extraordinary general meeting to discuss the removal of the liquidator. The administrator had refused to pass on the data based on the LGPD. However, the rapporteur considered that the situation falls under art. 11, II, a, of the LGPD, which allows the sensitive personal data processing without the authorization of the data subjects.
In short, from the aforementioned court decisions we have evidence that in the year 2022 the privacy issue should guide the main Brazilian jurisprudence