Privacy Litigation: Data Breach Lawsuits in Brazil

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The exponential growth of digital security incidents in Brazil has made personal data protection one of the most dynamic areas of litigation, with thousands of cases pending in courts across the country.

The Current Landscape of Data Breach Lawsuits in Brazil

We live in an era in which the mass collection of personal information has become the rule, not the exception. Companies of every size store immense volumes of data about customers, employees, and business partners, often without adopting the technical and organizational safeguards required by Brazil’s General Data Protection Law (LGPD, Law No. 13.709/2018). When that data is exposed, whether through a cyberattack, a system failure, or internal negligence, the legal consequences can be severe.

Brazil’s judiciary has been receiving a growing flow of cases involving data leaks, misuse of personal information, unauthorized sharing with third parties, and failures to obtain valid consent. These lawsuits include claims for compensation for moral and material damages, orders to perform specific acts (such as permanently deleting data) and, in more serious cases, fines and administrative sanctions imposed by Brazil’s National Data Protection Authority (ANPD).

Privacy litigation, as it is known internationally, has taken on its own shape in the Brazilian legal system. Unlike jurisdictions such as the European Union (governed by the GDPR) or the United States (with state laws such as California’s CCPA), the Brazilian model combines elements of tort liability, consumer law, and the LGPD itself to build a framework of protection that is still being consolidated in the courts.

Legal Foundations of Privacy Litigation

When we look at what supports these lawsuits, three main normative pillars emerge. The first is the LGPD itself, which establishes the rights of data subjects, principles for processing, legal bases for handling information, and a specific civil liability regime. Article 42 of the law provides that a controller or processor who causes property, moral, individual, or collective damage while carrying out data processing activities is obligated to repair it.

Consolidating privacy litigation in Brazil requires more than legal knowledge from legal professionals. It also requires a technical understanding of information security, data governance, and incident response mechanisms.

The second pillar is the Consumer Protection Code (CDC), which applies whenever the relationship between the data subject and the processing agent qualifies as a consumer relationship. In that context, liability is strict, meaning fault does not need to be proven. A large share of data breach lawsuits falls into this category, especially those involving companies that collect their customers’ data in the course of commercial activities.

The third pillar lies in constitutional guarantees, notably the right to privacy (art. 5, X, of the Federal Constitution), the right to intimacy, and informational self-determination, which Brazil’s Supreme Federal Court has recognized as an autonomous fundamental right. These constitutional foundations give data protection lawsuits a dimension that goes beyond mere financial compensation, reaching the protection of personality rights.

Civil Liability and the Reversal of the Burden of Proof

One important procedural point concerns how the burden of proof is allocated. In lawsuits based on the CDC, the judge may reverse the burden of proof when the consumer’s allegation is plausible or when the consumer is at a structural disadvantage. In privacy litigation, this reversal has been applied frequently, because data subjects rarely have access to technical information about how their data was processed, stored, or exposed. It falls to the processing agent to show that it adopted adequate security measures and that the incident did not result from a failure within its responsibility.

Presumed Moral Damages versus Proven Moral Damages

One of the most debated questions in the courts is whether a data leak, by itself, gives rise to compensable moral damages (damages presumed in re ipsa) or whether the data subject must prove actual harm. There are decisions going both ways. A significant portion of the case law holds that leaking sensitive data (health information, sexual orientation, biometric data, religious beliefs) amounts to presumed moral damages. For ordinary registration data (name, CPF (Brazil’s individual taxpayer ID number), address), some courts require proof of concrete consequences, such as fraud, improper charges, or specific embarrassment.

Data Due Diligence: Prevention as a Legal Strategy

Even before litigation comes into the picture, data due diligence is an organization’s first line of defense. It is a structured process of assessing, mapping, and verifying the personal data processing practices a company follows, whether in the context of corporate transactions (mergers, acquisitions, joint ventures) or as an ongoing governance practice.

Data due diligence involves, among other elements, a complete mapping of personal data flows within the organization, verification that the legal bases used for each processing operation are appropriate, an assessment of technical and administrative information security measures, a review of contracts with processors and third parties that access personal data, and verification that the data subject rights set out in the LGPD are being honored.

Organizations that maintain robust due diligence programs not only experience fewer security incidents but also respond better when incidents do occur. From a litigation standpoint, showing that the company followed diligent data protection practices can work as a mitigating factor (or even exclude liability altogether), especially where the breach resulted from the act of a third party or from an unforeseeable circumstance.

Essential Elements of a Compliance Program

For due diligence to be effective, an organization should maintain, at a minimum, an up-to-date record of processing operations (art. 37 of the LGPD), a Data Protection Impact Assessment (RIPD) for high-risk operations, documented and accessible internal privacy and information security policies, an incident response plan with clear procedures for notifying the ANPD and affected data subjects, periodic training for employees who handle personal data, and the appointment of a Data Protection Officer (DPO) with adequate autonomy and resources.

Procedural Strategies and Case Law Trends

On the procedural side, privacy lawsuits have their own characteristics, which call for specific strategies from both data subjects and processing agents. For data subjects, gathering evidence often depends on information under the defendant’s exclusive control. That makes it essential to use tools such as the production of documents (art. 396 et seq. of the Code of Civil Procedure, or CPC), advance production of evidence and, in some cases, a technical expert examination of information systems.

For processing agents, the most effective defense usually involves documentary proof of compliance with the LGPD, including consent records, access logs, security audit reports, and evidence of an adequate response to the incident. Companies that can show they have a robust privacy governance program tend to obtain more favorable outcomes, whether through lower damage awards or through exclusion of liability.

Class Actions and the Role of the Public Prosecutor’s Office

Collective actions are a particularly important tool in privacy litigation, given the often diffuse or collective nature of the harm caused by large-scale data breaches. The Public Prosecutor’s Office (Ministério Público), the Public Defender’s Office, and consumer advocacy organizations have standing to bring public civil actions seeking collective compensation for damages and orders to perform specific acts. This procedural route is likely to grow as major security incidents become more frequent and the ANPD steps up its enforcement.

Quantifying Damages and Compensation Parameters

Quantifying damages in data breach lawsuits still lacks settled parameters in Brazil. Awards for moral damages vary significantly among courts and levels of jurisdiction. Judges have considered factors such as the nature of the exposed data (sensitive or not), the number of data subjects affected, the processing agent’s conduct before and after the incident, repeat violations, and the economic capacity of the parties when setting the amount of compensation. The trend is toward a gradual increase in amounts as a culture of data protection takes hold in the country.

Future Outlook and Practical Recommendations

The privacy litigation landscape in Brazil is evolving rapidly. The ANPD has been publishing regulations and guidance that flesh out the obligations in the LGPD, creating clearer parameters for the conduct of processing agents and for judicial review of cases. Regulation of administrative sanctions, of the criteria for reporting incidents, and of minimum security standards is likely to make litigation more predictable.

Organizations of every size should treat LGPD compliance not as a regulatory cost but as a strategic investment. Implementing privacy governance programs, conducting periodic data due diligence, training teams on an ongoing basis, and maintaining effective channels for responding to data subjects all reduce the risk of incidents and also strengthen the company’s position in any litigation.

For data subjects who have been victims of a breach, it is important to document all available evidence (notifications received, fraud attempts, improper charges, screenshots of communications), seek specialized legal advice, and evaluate whether an individual or collective action is viable given the extent of the harm suffered.

This subject is directly related to personal data in court proceedings, a topic covered in a dedicated article.

This subject is directly related to the digital right to be forgotten, a topic covered in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.