The Court of São Paulo, Brazil, has ruled on a case between a laboratory who claim they did not need an individual’s consent to use their name and phone number to send messages promoting their services. The woman involved received WhatsApp messages from the laboratory despite not giving her personal data to them. They believed she may be interested in their services as she was pregnant. The woman had suffered a miscarriage in the days prior to receiving the messages.
Background
The laboratory messaged the Plaintiff offering their services to collect and store the umbilical cord after birth. They messaged the woman as they had information that showed that she was pregnant. The company confirmed that the woman had not sought out their services. Therefore, they can only have obtained the information from a third party.
It was argued by the laboratory that as they had only used the woman’s name and phone number in the message that this was non-sensitive and non-confidential data. They disputed that they should be held responsible for the disclosure that the woman was pregnant and that the physician or company that had shared this data with them should be the ones to be fined and penalised.
However, it was determined that the information regarding individuals’ health, i.e., currently pregnant, was key to the laboratory in attracting new customers. The pregnancy of an individual is sensitive data under the LGPD. While they did receive this data from a third party they also acted as a processing agent. Therefore, they had an obligation to identify the person responsible for collecting the woman’s data and present this information in the records. As they also operated as a processing agent they have a responsibility to redress any moral damages they have caused.
Fine and Appeal
It was determined that the laboratory was liable for the improper use of the woman’s data. This subsequently caused the woman moral damage as at the time of receiving the messages she was no longer pregnant. The company was ordered to pay compensation for moral damages in the amount of R$10.000,00 BRL (approx. $2,000 USD). This was appealed by the company for reasons mentioned above, such as:
- The physician or company who shared the data should have been liable
- They only used non-sensitive and non-confidential registration data
They also claimed there was no ground for moral damages as there was no illicit act or any violation of personal data. The judgement was confirmed and the appeal dismissed.
