Dr. Matheus Puppe comments on TI Inside, consulting personal data that violates the LGPD

Report from TI Inside, addressed the issue surrounding the protection of personal data involving the wide dissemination of information contained in labor and criminal actions on the internet. The Dr. Matheus Puppe, , partner in the TMT, Privacy & Data Protection area at Maneira Advogados was heard to comment on the matter.

Search tools that allow access to criminal and labor actions by consulting personal data violate the LGPD

By Writing

August 5, 2022

In an opinion sent to the Federal Supreme Court (STF) this Wednesday, 3rd, the Attorney General of the Republic, Augusto Aras, argues that the wide dissemination of information contained in labor and criminal actions on the internet, based on consultation by the name of the party, violates the fundamental right to data protection. The thesis is defended in an action with general repercussions in the Supreme Court, whose decision must be followed by other instances of Justice. In Aras's opinion, this type of disclosure, obtained from an internet search for the personal data of those involved in the processes, contravenes the General Data Protection Law (LGPD), and can lead to the website being held liable, including for moral damages.

The matter is addressed in Extraordinary Appeal with Appeal (ARE) 1307386, in which the Escavador website asks the STF to establish a national legal thesis, based on a decision handed down by the Court of Justice of Rio Grande do Sul (TJ-RS) in favor of the portal. The state court denied the request for compensation made by a citizen who had information about a labor claim he filed, published by the Google and Escavador search pages, based on consultation of his personal data. The case was dismissed by the TJRS, which considered it lawful for websites to disclose judicial content that is not confidential. This is the first time that the winning party in the original instance appeals to the Supreme Court so that the decision taken in its favor at the state level can be signed at the national level.

For the PGR, however, the ARE presented by the Escavador website should not be provided. Even in the case of actions without legal secrecy and available for consultation in the Judiciary's electronic systems, according to Aras, internet search portals enable a resource that is prohibited on official court websites, which is the possibility of searching using only the personal data of the parties, such as full name, general identification record, Individual Taxpayer Registry, among others.

In Justice systems and portals, public consultation of labor and criminal actions is only permitted based on the case number. This is because Resolution 121/2010 of the National Council of Justice and Resolution 139/2014 of the Superior Council of Labor Justice prevent the use of technological resources for broad and unrestricted consultation of these types of processes based on the name or other personal data of the people involved in the action. The objective is to avoid the formation of “dirty lists” of workers who have sued employers or any other form of discrimination.

According to Aras, the wide dissemination of procedural information of this nature by search sites violates the LGPD and may, in this specific case, cause harm to its holder. Furthermore, it contradicts the fundamental rights to privacy, intimacy and data protection, to the detriment of informational self-determination. When defending the dismissal of the ARE, the PGR argues that the disclosure of publicly accessible personal data by people other than their holders can only occur based on “the explanation of legitimate and specific purposes that consider the purpose, good faith and public interest that justified their availability”, which did not occur in the specific case.

“The processing of publicly accessible personal data by processing agents, in order to allow broad publicization and consultation by name of the parties of information in labor and criminal proceedings, exceeds the authorization of data processing by the LGPD, taking into account the lack of justification based on a specific legitimate and specific purpose and the violation of the rights of the holder”, assesses the attorney general. Furthermore, he highlights that the LGPD provides for civil and administrative liability, individual or collective, for those who irregularly disclose personal data, in the event of damage resulting to the holder of the published personal information. It also guarantees the data subject the right to anonymization, blocking or deletion of unnecessary, excessive information or that is treated in violation of the law.

Thesis

In the opinion, the PGR suggests theses to be established by the STF in Theme 1141 to be followed by other instances of the Judiciary in similar cases. For him, the Court must establish the understanding that the processing of publicly accessible personal data is conditioned on the explanation of legitimate and specific purposes that consider the purpose, good faith and public interest that justified their availability. The transformation of this data without due justification may give rise to civil and administrative liability for the processing agent who published the information, as proposed by Aras.

The PGR also opines that, after the data subject requests the removal of information, if the disclosure is maintained without justification supported by the LGPD, the existence of moral damage is presumed. Furthermore, it suggests that the thesis to be established considers the wide publicization and consultation of information in labor and criminal proceedings by name of the parties as violations of the fundamental rights to privacy, intimacy and data protection.

Successful Party Appeal

Regarding the fact that the website Escavador, which won the case in the first and second instance, appealed the decision, the STF considered that, from the moment the Extraordinary Appeal (RE) appears to be the appropriate path to allow the final analysis of the matter by the Supreme Court, it is possible that the winning party will also file the RE. In his opinion, Aras agrees with this position.

In this aspect, the PGR suggests that the thesis is to admit this type of appeal as long as it is presented in repetitive cases, the existence of jurisprudential divergence on the thesis already established regarding the topic is demonstrated and that the matter goes beyond the interests of the parties, having economic, political, social and legal relevance.

Opinion

“This topic takes us to a “fight of giants”, that is, Protection of Personal Data VS Principle of Advertising, both constitutionally protected. However, I believe that, if there is sensitive, private and intimate data of a person, even if there is no decree of judicial secrecy, the rule regarding publicity must be mitigated in favor of the autonomous and fundamental protection of the party's data, and confidentiality must be ensured of sensitive personal data, even if the procedural act is public”, says Antonielle Freitas, DPO (Data Protection Officer) at Viseu Advogados and member of ANPPD – National Association of Data Privacy Professionals.

“In the opinion, the PGR suggests that the processing of publicly accessible personal data is conditioned to “legitimate and specific purposes that consider the purpose, good faith and public interest that justified its availability”, however we must take into consideration that the data can still be processed with due Consent, Compliance with legal or regulatory obligation, Execution of public policies, Regular exercise of rights, Legitimate interest, among others, in this way, it is up to There are cases and cases and the situation must be analyzed not in an abstract and general way, but specifically for each type of tool, such as those that allow a limited and individualized search, based on legitimate interests to enable compliance with a legal or regulatory obligation, such as the practice of law, but I agree that indiscriminate use must be prohibited”, he emphasizes. Matheus Puppe, partner in the TMT, Privacy & Data Protection area at Maneira Advogados and member of the CNJ Compliance GT and the Judiciary Integrity Committee (CINT).