A database that shares consumer information must inform consumers in advance about the use of such data, under penalty of having to pay compensation for moral damages.
For the Third Panel of the Superior Court of Justice (STJ), the fact that the information is provided by the consumer at the time of a purchase, or even disclosed on social media, does not exempt the database manager from the responsibility to give prior notice of its sharing.
The panel established this understanding when denying the appeal of a data management company that was ordered to compensate a consumer in the amount of R$ 8,000 for the improper commercialization of personal and confidential information.
Fraud prevention
In the special appeal, the company argued that there would be no need for prior notification based on Article 43 of the Consumer Protection Code (CDC), since it does not engage in credit blacklisting, being merely a source of registration validation aimed at preventing the occurrence of fraud by comparing the information provided by the consumer to the merchant with that stored in the database. Further, according to the company, the consumer did not prove the occurrence of damages.
According to the reporting justice, Justice Nancy Andrighi, when it comes to the sharing of consumer information by databases, the rule set forth in item V of Article 5 of Law 12.414/2011 must be observed, which guarantees the registered party the right to be informed in advance about the identity of the manager and about the storage and purpose of the processing of personal data.
“The fact, in itself, that the data is usually provided by the consumers themselves, when making any purchase in commerce, and which do not constitute so-called sensitive or confidential data, does not exempt the database manager from liability, insofar as, when the consumer does so, they are not, implicitly and automatically, authorizing the merchant to disclose them on the market,” the justice explained, emphasizing that, in these situations, the consumer trusts in the protection of their personal information.
Presumed damage
The justice considered that the amendments to Law 12.414/2011 – introduced by Supplementary Law 166/2019 – do not exempt the database manager from notifying the consumer of the use of personal data.
“Although the new wording of this law proves to be less rigorous with respect to compliance with the duty to inform the consumer about their registration – since the original wording required prior authorization through informed consent by means of a signature in a specific instrument or in a separate clause –, the legislator did not relieve the manager and/or the source from carrying out effective notification.”
Nancy Andrighi stated that, in the event of the sharing of information without prior notice – as occurred in the case analyzed –, moral damage is presumed, and it is unnecessary for the consumer to prove harm.
Read also:
Court orders Anvisa to refund inspection fee – Valor Econômico article
Duty to inform
The reporting justice declared that “information about the consumer’s profile, even of a personal nature, has gained economic value in the consumer market and, for this reason, the database constitutes a service of great usefulness, whether for the supplier or for the consumer, but, at the same time, an activity potentially harmful to the latter’s personality rights.”
For the resolution of the case, she stated that it is important to consider the requirements of the law regarding the duty to inform, “which has as one of its aspects the duty to notify the consumer in writing of the opening of a registration, file, record, and personal and consumption data, when not requested by them, as determined by paragraph 2 of Article 43 of the CDC.”
Nancy Andrighi emphasized that the situation analyzed is distinct from the issue addressed by the Second Section in judging Theme 710 of the repetitive appeals, in 2014, when the panel decided that, in the credit scoring system, the prior and express consent of the assessed consumer cannot be required, since it does not constitute a registration or database, but rather a statistical model.
Source: STJ
← Back to blog