Civil Liability for Improper Processing of Personal Data

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Improper processing of personal data can give rise to strict civil liability for companies and organizations, with an obligation to compensate the affected data subjects for material and moral damages.

What Counts as Improper Processing of Personal Data

Brazil’s General Data Protection Law (LGPD) sets out a robust body of principles and rules governing how personal data must be collected, stored, used, and disposed of. Improper processing, as the concept is understood, covers any operation involving personal data that does not comply with the applicable law or that fails to provide the level of security the data subject can legitimately expect. This broad definition allows many different kinds of conduct to be classified as improper, from collecting data without an adequate legal basis to keeping data longer than needed for the stated purpose.

Improper processing can take many forms. We consider the following improper, for example: collecting data without the data subject’s consent when consent is the only applicable legal basis; sharing personal information with third parties without authorization or a legal basis; failing to put in place technical and administrative security measures proportionate to the risk involved; and using data for purposes other than those disclosed to the data subject. Each of these situations violates the principles of the LGPD and can give rise to civil liability for the processing agent.

One key point we see in practice is the distinction between the controller and the processor. The controller is the party that makes the decisions about processing, while the processor carries out the processing on the controller’s behalf. Both can be held civilly liable, but the extent of that liability depends on the role each played and how far each took part in the violation. A processor that acts strictly on the controller’s lawful instructions may, in certain circumstances, have its liability reduced, while a controller that orders the improper processing answers more broadly.

Legal Basis for Civil Liability Under the LGPD

The LGPD devotes a specific section to liability and compensation for damages. It provides that a controller or processor who, in the course of processing personal data, causes property, moral, individual, or collective damage in violation of data protection legislation is required to repair it. This provision fits directly within the civil liability framework already established in Brazilian law, especially the Civil Code and the Consumer Protection Code.

There is a significant scholarly debate over the nature of civil liability under the LGPD: whether it is strict (regardless of fault) or fault-based (depending on proof of fault). Those who favor strict liability argue that processing personal data is a risk-creating activity, especially when carried out on a large scale or involving sensitive data. On this view, you need only show the damage and the causal link for a duty to compensate to arise, with no need to prove fault on the part of the processing agent.

Others argue that the LGPD adopted a model of qualified fault-based liability, in which the processing agent’s fault is presumed and the agent must show that it acted diligently and in compliance with the law. This reading rests on the fact that the LGPD provides specific grounds for excluding liability: when the agent proves that it did not carry out the processing attributed to it, that there was no violation of the law, or that the damage resulted from the exclusive fault of the data subject or a third party. The existence of these exclusions suggests that liability is not purely strict, because it admits proof to the contrary.

Data protection due diligence is not merely a preventive measure. It is the processing agent’s main tool of defense when it faces civil liability for damages to data subjects.

Whichever view prevails, in practice processing agents bear a significant burden of demonstrating compliance with the law. Proper documentation of processing activities, data protection impact assessments, and privacy governance programs are essential, not only for preventing incidents but also for defending against lawsuits.

Data Due Diligence as a Preventive Tool

Data due diligence is a systematic process of investigating and evaluating an organization’s personal data processing practices. It works as a comprehensive audit: it identifies risks, checks compliance with the law, and proposes corrective measures before any violations harm data subjects and, as a result, create civil liability for the processing agent.

In a business setting, data due diligence is especially important in mergers and acquisitions, commercial partnerships, the hiring of technology vendors, and corporate restructurings. In these situations, a company that acquires or joins forces with another may inherit liabilities arising from improper processing of personal data by the acquired company or partner. For that reason, a careful review of data protection practices in advance is indispensable for reducing legal and financial risk.

The data due diligence process has several stages. First, we map all personal data flows completely, identifying what data is collected, for what purposes, with whom it is shared, where it is stored, and how long it is kept. Next, we assess the legal basis used for each processing operation, checking that it is appropriate and that the specific requirements of each legal basis have been met. We also examine the technical and administrative security measures in place, the contracts with processors and business partners, the mechanisms for responding to data subjects’ rights, and whether a privacy governance program exists.

One of the most important results of due diligence is identifying compliance gaps, meaning points where the organization’s practices do not fully meet legal requirements. These gaps are vulnerabilities that can lead to security incidents, complaints from data subjects, investigations by Brazil’s National Data Protection Authority (ANPD), and civil liability lawsuits. Fixing these vulnerabilities promptly significantly reduces risk exposure and strengthens the organization’s position if it is questioned in the future.

Types of Damages and How They Are Quantified

When you look at the consequences of improper processing of personal data, the damages can be either property-related (material) or non-property-related (moral). Material damages cover the actual economic losses the data subject suffers, such as financial losses from fraud made possible by a data leak, costs of containment measures (canceling cards, paying for credit monitoring services), and lost profits (lucros cessantes) when the incident affects the data subject’s professional activity.

Moral damages, in turn, concern the violation of the data subject’s personality rights, such as privacy, intimacy, honor, and image. Improper exposure of personal data, especially sensitive data (such as health information, sexual orientation, religious beliefs, or political party affiliation), can cause embarrassment, humiliation, discrimination, and psychological suffering. In these cases, moral compensation aims to make up for the emotional and psychological harm suffered.

Quantifying damages in cases of improper data processing remains a challenge for the Brazilian courts. We see courts weigh several factors when setting the amount of compensation: the nature and sensitivity of the data involved, the extent of the exposure (the number of people affected and how long the incident lasted), the conduct of the processing agent (whether there was intent, gross negligence, or a mere isolated failure), the measures taken to mitigate the effects of the incident, and the economic capacity of the parties.

Collective damages, which affect many data subjects at once, also deserve mention. In these cases, the Public Prosecutor’s Office, the Public Defender’s Office, the ANPD, and consumer protection organizations can bring class actions seeking compensation for the harm done to the entire affected group. Awards in class actions tend to be substantially higher, reflecting the scale of the incident’s social impact.

Practical Steps to Reduce Liability Exposure

We consider it essential for organizations to take a proactive approach to protecting personal data, putting concrete measures in place that reduce the likelihood of incidents and strengthen their defense if they are held liable. The first step is to appoint a qualified data protection officer (DPO) who serves as the focal point for privacy matters and as a channel of communication among the organization, data subjects, and the ANPD.

Creating and maintaining records of processing activities is equally indispensable. These records document every operation involving personal data, including the purposes, legal bases, retention periods, and security measures applied. If the organization is challenged in court or before an agency, this documentation is relevant proof of the processing agent’s diligence and can be decisive in excluding or reducing liability.

Investing in information security is another fundamental pillar. Implementing technical controls (such as encryption, access control, intrusion monitoring, and regular backups) and administrative controls (such as security policies, employee training, and incident management) shows the organization’s commitment to protecting the data in its custody. The absence of these measures, on the other hand, amounts to negligence and significantly aggravates liability if an incident occurs.

Periodic internal due diligence and outside audits round out the compliance program. These assessments make it possible to identify new vulnerabilities, check how well the measures in place are working, and adapt the organization’s practices to regulatory and technological developments. We recommend conducting these reviews at least once a year, or whenever there are significant changes to data processing operations.

Finally, an incident response plan that sets out clear procedures for containing, investigating, reporting, and remediating data breaches can make a significant difference, both in minimizing damages and in showing the processing agent’s good faith before the courts and the ANPD.

This topic is directly related to the LGPD and civil liability for data leaks, which we cover in a dedicated article.

To round out your reading, see also the firm’s article on civil liability for AI-related damages.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.