THE AUTOMATIC (IN)APPLICABILITY OF THE CONSUMER PROTECTION CODE FOR CIVIL LIABILITY IN CASE OF PERSONAL DATA LEAKS IN BRAZIL

Abstract

This article analyzes the nature of civil liability in the Brazilian legal system in cases of personal data leaks, with a special focus on the controversy surrounding the automatic applicability of the Consumer Protection Code in light of the provisions of the General Personal Data Protection Law. Starting from the context of the information society and the significant increase in security incidents in the digital environment, we examine the legal regime established by the LGPD, especially with regard to processing agents, security duties, and the cases of civil liability provided for in Articles 42 to 45. Next, the incidence of the consumerist microsystem in cases of personal data leaks is investigated, based on the conceptualization of consumer and supplier, the adoption of the theory of business risk, and the legal exclusions capable of breaking the causal link. The research adopts a qualitative approach, of a theoretical-dogmatic nature, using the deductive method, based on legislative, doctrinal, and jurisprudential analysis. In the field of jurisprudence, decisions by state courts and the Superior Court of Justice are examined, highlighting the lack of uniformity regarding the configuration of civil liability, the requirement of proof of damage, and the characterization of presumed moral damage, especially in view of the distinction between common and sensitive personal data. In conclusion, it is concluded that the application of the Consumer Protection Code to cases of personal data leaks should not occur automatically, but should be preceded by a concrete verification of the existence of a consumer relationship, in a systematic and complementary reading with the LGPD, in order to ensure the effective protection of the fundamental rights of data subjects, without undermining the regulatory autonomy of the personal data protection regime.