By: Leonardo Neri

We have collected some court decisions from Court of Justice of the State of São Paulo containing grounds in the LGPD. The following stand out:

• The 34th Private Law Chamber exempted Eletropaulo from paying compensation to a customer for data leaks. The judge emphasized that the company was not to blame for the incident, which was caused by hackers.
• In another decision involving Eletropaulo, the 29th Private Law Chamber denied a claim for moral damages made by a customer who also had his data leaked. “In cases like the present one, in this sense, in addition to the finding of irregularity in the processing of user data, necessary for the intended compensation is proof, for example, of the effective use of said information by third parties, or at least the minimum specification of the consequences resulting from improper use, which undoubtedly did not occur in this case,” it stated.
• The 4th Private Law Chamber ordered two construction companies to block the personal data of a customer. The consumer alleged that, after entering into a contract with the defendants, he began receiving calls and messages from third parties unrelated to the commercial relationship, offering services for the property purchased. The rapporteur also dismissed the construction companies' argument that the LGPD would not apply to the case, since the contract with the customer was signed in 2019 and the rule only came into force in 2021: “These rights did not come into existence as a result of the LGPD, on the contrary: they gave rise to the specific law, as they had been present in our legal system for a long time.”
• An educational services company was convicted by the 30th Private Law Chamber after an employee passed on a client's phone number to another person. The student, in addition to not having authorized the number to be sent, also began to be harassed by WhatsApp messages. The rapporteur dismissed the argument of passive illegitimacy raised by the company. According to her, the event that gave rise to the damages was the transfer of the plaintiff's cell phone by an employee of the defendant to a third party. “This breach of the duty to protect data attracts liability for moral damages (LGPD, art. 42)”, she pointed out.
• The 7th Private Law Chamber denied a request for the “right to be forgotten” from a man convicted of copyright infringement to have his name and image removed from news published on the internet in 2014.
• The 31st Private Law Chamber ordered a condominium administrator to provide residents' personal data (such as full name, email and telephone number) to a group of condominium owners who intend to call an extraordinary general meeting to discuss the dismissal of the condominium manager. The administrator had refused to provide the data based on the LGPD. However, the rapporteur considered that the situation falls within the scope of art. 11, II, a, of the LGPD, which allows the processing of sensitive personal data without the consent of the data subjects.  

In short, based on the aforementioned court decisions, we have evidence that in 2022 the issue of privacy should guide the main Brazilian case law.