BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
hours in remote work and the so-called “broad base”, a non-formal platform that gathers personal data of various types, including sensitive data, to establish behavioural patterns and guide hiring decisions based on employee profiles. Litigation related to personal data and privacy has also strongly influenced the courts, which now recog - nise convictions based on presumed moral damage, or even moral damage for the repeated practice of violations of personal data legislation. Although with some caution, jurisprudence already considers that, under certain circumstances, moral damage arises from the mere absence or ineffectiveness of internal mechanisms of organisations, which results in secu - rity incidents. Incidents which were previously con - sidered “external fortuitous” (attributable to causes beyond the control) are beginning to be seen as an “internal failure”, a defect in practices and policies, under the responsibility of the personal data controller. Assessing the effects of a data breach, for example, is still done cautiously, and on a case-by-case basis. Factors include if the violated data is sensitive, if the impacted person is a child or elderly, if the event had public repercussions, or if it was nothing more than a mere inconvenience. 2.2 Recent Case Law More recently, some courts, especially the one in São Paulo, have decided that “hacker” attacks on systems cannot always be considered an “external fortuitous” (cause beyond the control of the organisation). If the company does not demonstrate, with evidence, that it adopts and practices adequate security measures, the case is one of “internal fortuitousness”, in line with the principle of accountability (LGPD, Article 6, X). Another important basis for decisions is to consider that the data controller is only exempt from being liable for a personal data breach if it proves one of the so-called “exclusions”, as provided for in Article 43 of the LGPD. At the end of 2025, the Superior Court of Justice rec - ognised the existence of presumed moral damage in a case of sharing personal data related to the monthly income, address, and personal telephone numbers
of consumers to third parties, regardless of proof of actual harm, on the grounds that this type of conduct violates the legitimate expectations, privacy, and per - sonality rights of the data subject. 2.3 Collective Redress Mechanisms A topic under discussion in Brazil is whether there is a basis for collective or diffuse (indistinct) compensation for damages resulting from violations of personal data protection legislation. In general terms, collective redress in Brazil is a reg - ulated and mature matter in the courts, serving to safeguard rights that are not strictly individual and to provide financial compensation (if applicable), based on the Federal Constitution and developments under the Consumer Protection Code and the Public Civil Action Law (Law 7.347/85). What has been put to the test is whether, in the con - text of personal data as a fundamental right, in which the privacy and intimacy of individuals are at stake, collective or diffuse remedies are the most appropri - ate. The General Data Protection Law does not refer to “diffuse damage”, but to “collective damage” (Article 42). The distinction matters. In cases of “diffuse dam - age”, the impact falls on an indistinct set of individu - als, not necessarily belonging to a specific or deter - mined collective. In the case of “collective damage”, a group or class of individuals is impacted, directly or indirectly, and thereby acquires the right to seek repa - ration. Therefore, if a security incident impacts not only certain individuals, but a collective of them, the legal framework for comprehensive reparation (“col - lective”) applies. This reparation covers both the pat - rimonial (material) and the moral (immaterial) aspects, and the controller or operator is fully responsible. Collective damage can be claimed by the Public Prosecutor’s Office, the Public Defender’s Office, the Union, states, municipalities or legally constituted associations. However, the reparability of the damage requires the fulfilment of certain conditions. First, the damage must have resulted from the activity of the processing agent
18 CHAMBERS.COM
Powered by FlippingBook