By Leonardo Neri and Barbara Oliveira 

Last week, Judge Cesar Loyola, of the Second Civil Chamber of the Court of Justice of the Federal District and Territories, granted, in advance of protection, the request to suspend the commercialization of personal data by Serasa SA, under penalty of a fine of R$5,000.00 (five thousand reais) per sale made.

The appeal was filed by the Public Prosecutor's Office of the Federal District and Territories (MP-DF), after the request for urgent relief was denied by the Court of the 5th Civil Court of Brasília - DF, in the Public Civil Action No. 0736634-81.2020.8.07.0001.

According to the Public Prosecutor's Office, Serasa SA would be selling personal data of Brazilian data subjects, through services called “Online List” and “Customer Prospecting”, without due specific consent, nor guarantee of the expected security, which would configure a major security incident, in direct violation of the General Data Protection Law (LGPD), in addition to other legislation, such as the Consumer Defense Code, the Internet Civil Framework and, mainly, the Federal Constitution.

The Serasa SA database would have around 150 million CPFs and, according to the MP-DF, the commercialization comprises a package of personal data, such as name, CPF, contacts, address, age, gender, purchasing power, social class, among others, sold at R$ 0.98 per contact.

The MP-DF highlights in its appeal the risks arising from this undue commercialization of personal data on the eve of the municipal elections, due to the use of data for mass sharing of information that can manipulate voters, which has generated a great effort on the part of the TRE.

Thus, the Rapporteur Judge decided to grant the requested appeal, recognizing the activity of Serasa SA as a data processing activity and applying to the case art. 7, item I, of the General Data Protection Law (LGPD), which requires the consent of the data subject to carry out the processing of his/her personal data. The provisions of § 5, of art. 7 of the LGPD were also highlighted, regarding the obtaining of new specific consent when it is necessary to share personal data with third parties.

For the Judge, even if the processing is carried out based on meeting the legitimate interests of the controller or third parties, the fundamental rights and freedoms of the holders must be respected, as well as the foundations of art. 2 of the LGPD must be compatible, having, on the one hand, economic and technological development, free initiative and free competition, and, on the other hand, respect for privacy, informational self-determination and the inviolability of privacy, honor and image.

This is a court decision that has a strong impact on the market and directly affects a practice that has been commonplace in recent years, due to the virtualization of businesses and the ease of exchanging information and personal data to promote products and services that are more suited to the desires of the end consumer and, consequently, to the desire for corporate profits. The LGPD shows what it is here for, and is already having repercussions in the market chain, indicating the need for a change in behaviors that will no longer have any place from now on.