04 Mar THE THIRD CHAMBER OF THE SUPERIOR COURT OF JUSTICE (STJ) RULES THAT ANY SHARING OF INFORMATION FROM DATABASES MUST BE PREVIOUSLY INFORMED TO THE CONSUMER
The Third Chamber of the Superior Court of Justice (STJ) unanimously upheld the condemnation of a database company for failing to inform the consumer, in advance, that his/her data have been shared with third parties. The company was ordered to exclude the registration information of the individual who filed the lawsuit and to pay punitive damages.
The company pleads that the purposes of sharing personal data with third parties are restricted to validate registers and verify information provided by consumers, and to avoid frauds to their client’s businesses. Regarding this allegation, the company states that their business model is not subjected to the duty of information provided by the article 43, §2, of the Consumer Protection Code (“CDC”), and also that this practice does not result in concrete damage to the data subject.
The decision, reported by Justice Nancy Andrighi, is not based on the LGPD, which will come into force only in August this year¹. For this reason, it is supported by Law No. 12,414 / 2011 (popularly, “Positive Registration Law”), as amended by Complementary Law No. 166/2019 (“LC 166/19”), and by the provisions of the CDC that regulate (and sometimes restrict) the activity of companies that manage consumer databases.
The main ground of the conviction is the duty to inform the consumer provided for (i) in article 4, I and § 4, of the Positive Registration Law, and (ii) in article 43, §§ 1 to 6, of the CDC. In the first case, the database manager can register information on the financial management of individuals and companies as long as the fact is communicated to the registered person within 30 days. In the second case, the CDC imposes rules on consumer databases and registrations, such as access to their information, the right to correct them and the duty to be informed about their data records.
For the Third Chamber of the STJ, if the company commercially benefits from the sharing of information, it must, therefore, comply with the content of article 5, V, of Law No. 12.414 / 2011: it must inform the consumer about the identity of the manager, the data storage and the purpose of the processing personal data. Additionally, such a rule must be complied with even in the case of positive registrations, since it is supported by an even broader consumer right, which is the right to access your own stored data and rectify it, as provided by the CDC.
The ruling’s main assumption is that there are general duties associated with the processing of data (which includes the collection, storage, transfer to third parties and the duty to inform). Whenever these general duties are violated, the right of the individual to immediately stop the offense to his personality rights and to be compensated for the damages caused by such practice arises, which, in this case, would be presumed (therefore, automatically configured, regardless of proof).
In detailing the facts of the case under discussion, the Third Chamber states that, by providing data for a purchase, the consumer is not, implicitly and automatically, authorizing the merchant to disclose or process them for commercial purposes; the consumer is only fulfilling the necessary conditions for the completion of the operation, entrusting the supplier with the protection of its personal information. The same would happen with data published on the social network.
Even though the judgment does not invoke or comment on LGPD principles or rules – insofar as it is based on other legal provisions – it is possible to infer that if the LGPD was in force with its current wording, it would lead the same case to a similar outcome.
First, because the LGPD reproduces, to a large extent, the content of the legal basis invoked in the judgment (that is, those of the Positive Registration Law and the CDC, already mentioned). Second, because the LGPD, in certain aspects, is even more incisive and broad in terms of the duty to inform, and restrictive in the processing of personal data.
For example, in the current wording of the LGPD, it is possible that, in addition to the duty to inform, the data subject’s consent is also required to legitimize the processing activities by agents that offer access services to databases containing personal data. Besides, it is important to note that the set of rights of the data subject provided for in Article 18 of the LGPD ends up enlarging the obligations of these same companies.
The data subject may, for example, demand anonymization, blocking or even the elimination of personal data that are unnecessary and/or excessive to the purpose of the processing, expanding rights already provided for in the Positive Registration Law and the CDC.
For companies, therefore, the case recently decided by the STJ – although it represents the understanding of only one Chamber -, constitutes as a warning: the interpretation of the LGPD and other rules that make up the legal framework for data protection must be made in an integrative manner, to help controllers and processors to minimize risks and properly plan their businesses and activities.
¹The Bill 5762/2019, presented by Deputy Carlos Bezerra, which is being processed by the Chamber of Deputies, aims to postpone, for the second time, the entry into force of the LGPD until August 15, 2022, that is, in another 2 years. The process of the project, however, has been at a standstill since 21 November last year, when it was appointed a rapporteur to chair the sessions at the Constitution and Justice Commission (“CCJ”). The deadline for entry into force provided for in the LGPD has already been postponed by 6 months concerning the initial term.
This article is intended exclusively to provide information and does not contain any opinion, recommendation or legal advice from KGV Advogados concerning the matters herein addressed. Copyrights are reserved to Kestener, Granja & Vieira Advogados.
No Comments