Brazilian Website Ordered to Cease Selling Personal Data

The Brazil Court of Justice has decided to uphold an urgent injunction filed by the Public Ministry’s Data Protection Unit. It was found that the defendant’s website was selling personal information to companies for marketing purposes without obtaining express consent from the data subjects.

Case background

The Ministry found that the defendant was using a website to sell personal data to advertisers. The information being sold included:

• Name
• Address
• Phone number
• Email
• Profession

According to the LGPD personal data can be processed in this way if:

• The data was obtained with the express consent of the data subject
• If the data is obtained without consent it is because the data subject made the information public

Law No. 13,105 of 2015 grants emergency relief where there is a probability and danger of damage or risk to a useful outcome of a case (Article 300). The Ministry filed for said urgent relief and asked for two immediate actions. Firstly, the website provider removes the defendant’s website. Secondly, the Defendant must delete all data and refrain from selling or distributing individual’s private data.

Outcome

It was found that the Defendant’s commercial activities of selling this data was a clear violation of LGPD. The main factors in this decision were that the process involved negotiation of private information without express consent. Also, the exceptions that would waive the consent requirement under section 7 do not apply to this situation.

The Ministy’s request was granted and the Defendant was ordered to do the following:

• Refrain from commercializing the personal data they have access to
• Destroy all the data handled in violation of LGPD
• Bring their website into compliance or it will be deactivated.

Cases like this show that even if your company doesn’t receive a fine for misuse of personal data the cost of court proceedings and actioning the courts orders can still be very costly. This is before you even consider the impact it has on future business and reputation. LGPD is still relatively new and you may not be sure if your company is handling your data correctly. Our experts will assess your practices and policies and tell you what needs to be done to comply with the regulations. We can then maintain this for you and handle any data requests and ensure you comply with any future changes. Contact us today to find out how we can help.