Civil liability for the processing of personal data in the general data protection law

Abstract

The General Data Protection Law (Federal Law No. 13.709/18, “LGPD”) incorporates, into the Brazilian legal framework, several instruments to ensure the protection of personal data, providing control to the data subjects of their data by ensuring more transparency and security throughout the entire data processing chain. The LGPD also establishes the legal consequences in cases where personal data is processed in breach of its provisions. Among these consequences, for the purposes of this article, we are interested in the civil liability of processing agents, as the LGPD was not explicit in defining the applicable civil liability regime. In this sense, this article proposes to present this discussion, exposing the main arguments, on the one hand, of those who argue that the applicable regime is the subjective civil responsibility and, on the other hand, of the current that defends the objective civil liability of processing agents. The aim of this article is, therefore, to consolidate the main arguments involving the discussion about the civil liability of treatment agents and to present guidelines for the best framing of the theme in the Brazilian legal system.