A decision published on March 23, 2023, based on the Brazilian General Data Protection Law (LGPD), by the trial court of diffuse and collective interests of Maranhão, ordered Facebook to pay the value of R$ 500 as moral damages to each one of the users affected by the personal data breach occurred on the platform in 2021. It is estimated that the personal data of around 8 million users in Brazil were leaked, which can result in an indemnification of R$ 4 billion. The same decision also ordered Facebook to pay R$ 72 million as collective damages to the State Fund of Diffuse Interests. 

Although it is a trial court’s decision, which can be reverted, it is interesting to notice such decision conflicts with a recent decision issued by the Superior Court of Justice (STJ) on March 10, 2023, in which STJ understood that indemnification for moral damages related to data breaches is subject to evidence of actual damages suffered by the data subject.  

In the administrative field there has also been an important development: after the publication of the Regulation for application of sanctions and the methodology for calculation of administrative fines, the Brazilian National Data Protection Authority (ANPD) has disclosed a list with the first sanctioning administrative procedures in progress against eight entities (one private and seven governmental), regarding alleged violations of LGPD. 

We can see a growing movement of judicial and administrative authorities on data protection matters, making LGPD compliance crucial to companies in Brazil. 

For more information, please contact the heads of the Privacy and Data Protection team, Adriano Chaves and Marcia Issler Mandelbaum.