Application of civil liability under the LGPD: analysis of a precedent of the Superior Court of Justice

Abstract

This article examines the application of civil liability within the framework of the Brazilian General Data Protection Law (Law No. 13,709/2018), focusing on the analysis of a recent precedent issued by the Superior Court of Justice. It initially presents the historical development and foundations of civil liability, highlighting its requirements and main characteristics. It then examines the principal aspects of the LGPD, including its foundations, principles, and the legal framework governing the liability of data processing agents. The study addresses the doctrinal debate concerning the legal nature of the liability established under the LGPD, emphasizing the divergence between scholars who advocate strict liability and those who support fault-based liability. It subsequently analyzes the judgment in AREsp No. 2,130,619/SP, in which the Superior Court of Justice held that the leakage of personal data, by itself, does not give rise to presumed moral damages, requiring effective proof of the harm suffered. The methodology adopts a qualitative, bibliographic, and documentary approach, developed through the deductive method. It concludes that the interpretation adopted by the Superior Court reinforces the need for concrete proof of damage, in line with the Brazilian tradition of civil liability, while raising concerns regarding the effectiveness of the protection afforded to data subjects’ rights.