By Barbara Oliveira

The Third Panel of the Superior Court of Justice unanimously decided, in Special Appeal 1,758,799, that the lack of communication regarding the commercialization of personal data in consumer databases is grounds for sentencing to pay compensation for moral damages.

For the Rapporteur, Nancy Andrighi, whose vote was supported by the others, the provision of data by the consumer does not imply the presumption of authorization for the commercialization or disclosure of their personal information, but only compliance with what is necessary to carry out a certain legal transaction.

The decision was based on the Consumer Protection Code, in particular, on the duty to inform, attributed to the supplier by article 43, in addition to mentioning the definitions brought by Law 12,414/2011, which deals with the formation and consultation of a database with information on compliance for the formation of credit history.

The Rapporteur Minister also highlighted the economic value attributed to databases containing consumers' personal information, constituting a valuable market aspect, which results in potential violation of their personality rights.

The Third Panel's understanding is that, even though the original wording of Law 12,414/2011 has been changed – which previously required express authorization to open a registry, carried out in a separate clause or specific instrument – the new wording does not eliminate the responsibility of the data manager to provide the appropriate information to the consumer, even if with less formality.

For the Ministers, the duty to provide information applies to both negative and positive information related to consumers, aiming to protect the rights of access to stored data and the rectification of incorrect information.

The possibility of sharing personal information, authorized by law, makes the lack of communication to the consumer regarding the data collected, stored or sold even more worrying. This is because the lack of information to the consumer facilitates the spread of incorrect or outdated data, often resulting in the formation of a harmful history.

According to the Rapporteur, given the seriousness and consequences of the conduct, failure to observe the rules governing the processing of consumer data, in itself, “[…] gives rise to the claim for compensation for the damages caused and to immediately cease the violation of personality rights.”, in particular, due to the possibility of economic benefit for the data manager.

In the specific case, which is the subject of the trial, it was found that excessive information had been recorded and sold, such as data on possible relatives, residents of the same address and neighbors of the indicated address, which exceeds the legal limits and constitutes compensable damage, which is why the appeal was denied, maintaining the sentence for compensation for moral damages in the amount of R$8,000.00 (eight thousand reais).

The judgment reflects the trend in the Superior Court's case law understanding related to the processing of consumers' personal data, demonstrating an increase in the severity of measures adopted against abusive practices by data managers, especially due to the commercialization of information without consent.