A aplicação da responsabilidade civil à luz da LGPD: um estudo sobre o vazamento de dados pessoais pelo INSS

Abstract

The present research aims to delve into the topic of personal data protection, especially when the data controller is the State itself, in order to analyze how jurisprudence applies civil liability in cases of inadequate data processing. In this regard, the article is organized into three stages, with the first one focused on explaining the extensive generation and processing of data in the digital age, as well as the increasing economic value and potential uses of this information. In a second moment, the legislative evolution regarding data protection in Brazil is addressed, leading to the General Data Protection Law (LGPD), in order to ensure fundamental rights to privacy and informational self-determination. In this same chapter, it is discussed the gap left by the LGPD regarding the regime of civil liability that should apply to data breaches or unlawful processing of personal data. It is pointed out that the LGPD does not provide an explicit provision for the application of subjective or objective liability. Finally, in order to discuss the State's role as a data controller, the example of the National Institute of Social Security (INSS) is used, demonstrating how the collection and processing of information by the autarchy occurs, as well as highlighting the existence of data leaks and the commercialization of personal data with third parties without the consent of the data subjects. In light of the above, it is shown how jurisprudence deals with data breaches by INSS, as well as how the LGPD is being applied, especially with regard to the regime of civil liability.