By: Leonardo Neri
A recent decision issued by the Superior Court of Justice (“STJ”), through Rapporteur Minister Francisco Falcão, and the other members of the Second Panel of the STJ, during the trial of the Appeal in Special Appeal No. 2,130,619-SP (2022/0152262-2), brought a lot of movement to the legal world, and a great victory to administrative cases, given the use of Law 13,709/2018, to cease the condemnation for moral damages due to the leaking of common and sensitive data.
In summary, it is necessary to clarify that the difference between personal data and sensitive data is set out in art. 5, items I and II, of the aforementioned Law, which states: “I – personal data: information related to an identified or identifiable natural person”; “II – sensitive personal data: personal data on racial or ethnic origin, religious belief, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data, when linked to a natural person”.
The case in question involved a citizen who had filed a lawsuit for compensation against an electric power company for having leaked his personal data to third parties. The judgment had found the Plaintiff's claims to be admissible, however, it was reversed on appeal, and the appeal was partially accepted, with partial provision.
The Panel decided that the Concessionaire was right, since the leaked data was of a personal nature, that is, data that was easily accessible to any citizen, and not sensitive data as determined by the E. Court of Justice. Sensitive data is present in an exhaustive list, so that any data that is not included in this list cannot be considered as such, and the party is not entitled to any compensation.
Thus, it was clear that the Panel correctly applied Article 5, item II, of the aforementioned Law, since a Concessionaire, or other companies, cannot be held liable for the leaking of personal data, which many have easy access to through the individual's registration on platforms or websites that make the information available, so that only the disclosure of sensitive data – which directly identifies a person, and is expressly included in the exhaustive list – is subject to compensation in the context of this episode.
Therefore, it is clear that the decision on the appeal is extremely favorable, since it guides the understanding of the other Panels on the difference between personal and sensitive data, and that it does not call for any data leak or compensation to the citizen, having to be analyzed on a case-by-case basis. For more information on the subject, as well as on the provisions applied in the General Data Protection Law, contact the partner responsible for the data protection team, Leonardo Neri.