Civil Liability for Data Breaches: How to Calculate Collective and Individual Moral Damages

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Quantifying moral damages in data breaches has become one of the most contested points in the application of Brazil’s General Data Protection Law (LGPD), with courts swinging between recognizing presumed harm and requiring the victim to prove concrete loss.

Presumed Harm or Harm That Requires Concrete Proof

The first fault line in the case law on security incidents is the very existence of harm. One view holds that the mere improper exposure of personal data injures the person’s personality rights and gives rise to compensation, regardless of proof of loss. This is the theory of presumed harm, also called dano in re ipsa (harm presumed from the act itself), which follows from the violation alone.

The other view, which has taken hold in Brazil’s higher courts, is more restrictive. According to this line of decisions, the leak of ordinary registration data, such as a name, phone number, or address, does not automatically cause compensable moral harm. The victim must show concrete consequences, such as fraud, fake accounts opened in their name, financial scams, or genuine psychological distress.

This distinction decides the outcome of the lawsuit. When the judge adopts the presumed-harm theory, you only need to prove the leak and that the data was yours. When the judge requires proof of loss, the burden of proof falls on the person whose data was exposed, and the lack of evidence of misuse often leads to dismissal of the individual claim for compensation.

A middle ground is gaining traction in recent rulings. Under this reading, the presumption of harm varies with the category of information leaked. Ordinary registration data would require proof of loss, while sensitive data, because it is more likely to cause discrimination and distress, would justify recognizing the injury from the fact of exposure alone, with no additional showing by the data subject.

The Role of the ANPD and the Difference Between Penalties and Compensation

People often confuse two spheres that do not connect directly. The ANPD (Brazil’s National Data Protection Authority) works in the administrative arena, overseeing how data is handled and imposing penalties on those who violate the law. Civil compensation, by contrast, is decided by the courts, in a lawsuit brought by the injured data subject or by parties authorized to sue on behalf of a group.

On the administrative side, Law 13.709 of 2018 provides for sanctions ranging from a warning to a fine of up to two percent of the company’s revenue, capped at fifty million reais per violation. The penalty may also be made public, and the data involved may be blocked and deleted. These measures punish and deter misconduct, but they do not send any money directly to the victim.

Compensation for moral damages is a different matter. It compensates the data subject for the injury suffered and follows the logic of civil liability. The authority’s actions can nonetheless serve as significant evidence in the court case, since they may recognize the security failure and the controller’s responsibility for the incident.

This separation explains why the same company can be fined by the authority and, at the same time, face thousands of individual lawsuits or a class action. The administrative, civil, and even criminal spheres can all apply to the same event, and none excludes the others.

It is worth remembering that the controller’s civil liability does not depend on fault in many situations. The law requires anyone who handles data to adopt adequate security measures, and the occurrence of an incident in itself suggests a breach of that duty. It is up to the company to prove that it did not violate the law or that the harm resulted solely from the act of a third party or of the victim.

The penalty may also be made public, and the data involved may be blocked and deleted.

How the Courts Set the Amounts

Once a duty to compensate is established, the challenge is determining the amount. There is no statutory table for setting moral damages. Courts rely on parameters established by legal scholarship and case law: the extent of the harm, the offender’s financial capacity, the nature of the data exposed, and the educational purpose of the award.

In individual cases involving registration data, when harm is recognized, awards tend to be modest, generally in the range of a few thousand reais. The aim is to avoid unjust enrichment of the data subject and the so-called “moral damages industry,” a concern often voiced in rulings on the exposure of low-sensitivity information.

The picture changes in class actions. When an incident affects thousands or millions of data subjects, the focus shifts to collective moral damages, which aim to redress a diffuse injury to the community of affected people. The method considers the size of the company, the seriousness of the security failure, and the number of people exposed.

In these cases, brought as a public civil action (ação civil pública, a collective lawsuit) by the Public Prosecutor’s Office, the Public Defender’s Office, or associations, the judgment usually directs the money to funds for the repair of diffuse rights rather than to each data subject’s pocket. The model resembles the “fluid recovery” mechanism provided for in collective consumer protection, and it serves a preventive and deterrent function.

The collective method also weighs repeat offenses and the company’s conduct. Companies that have already suffered earlier incidents, or that ignored internal vulnerability warnings, tend to face harsher awards. The stated goal is to make the penalty economically painful, so that investing in information security costs less than paying collective compensation.

Factors That Increase the Award

Several factors significantly raise the amount awarded. The first is the nature of the data. The leak of sensitive data, a category that covers racial origin, religious belief, political opinion, health data, sex life, and biometric information, receives stricter treatment. Exposing this kind of information carries a greater risk of discrimination and harm to dignity.

The second factor is the data subject’s vulnerability. Data of children and adolescents enjoys heightened protection, guided by the principle of the best interest of the minor. Exposing information about this group usually aggravates the liability of the data processor, because the failure is considered more serious and because the data subjects cannot protect themselves.

The third factor is the purpose of the misuse. When leaked data fuels fraud, swindles, identity theft, or financial scams, compensation tends to rise, because the harm is no longer hypothetical and becomes concrete financial and psychological damage. Proof of criminal use strengthens the claim for compensation and defeats the argument that the incident was a mere annoyance.

The controller’s conduct after the incident also matters. Failing to notify the authority and the data subjects in a timely manner, trying to conceal the failure, and having no reasonable security measures in place all work as aggravating factors. Transparency and prompt containment measures, on the other hand, may be weighed in the company’s favor when the amount is set.

Frequently Asked Questions

Does every data breach give rise to a right to moral damages?

Not necessarily. For ordinary registration data, Brazil’s higher courts tend to require proof of concrete loss, such as fraud or scams resulting from the exposure. A mere violation, without evidence of consequences, is often treated as a simple annoyance. Exposure of sensitive data, on the other hand, tends to be judged more strictly, with a greater chance that harm will be recognized.

What is the difference between action by the ANPD and a lawsuit for compensation?

The administrative authority oversees and punishes the data processor, imposing sanctions ranging from a warning to a fine, without passing any money on to the victim. Compensation for moral damages is decided by the courts and compensates the data subject for the injury suffered. The two spheres are independent, and an administrative penalty can serve as relevant evidence in the civil lawsuit.

What makes compensation for a data breach higher?

Three factors usually raise the amount: the sensitive nature of the data exposed, the vulnerability of the data subject, especially children and adolescents, and the criminal purpose of the misuse, such as fraud and swindles. The controller’s conduct after the incident also matters, since failing to give notice and lacking security measures are aggravating factors when the amount is set.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.