Imagine this scenario: you hand over the keys to your house to a smart condominium. From then on, the doors open automatically, services adjust to your preferences, and life seems simpler. However, while these conveniences are made possible, each new copy of the key that circulates increases the risk of misuse, loss, or even break-in.

In Open Finance, the logic is no different. Once consent is given to financial data, the consumer opens the way for more personalized products, more competitive rates, and greater financial inclusion, which is excellent. However, with each new authorized access, the responsibility to protect these "digital keys" also grows.

Behind the engine of this giant ecosystem are APIs ( Application Programming Interfaces ), which function as standardized digital bridges, allowing different financial institutions, such as banks, fintechs, credit unions, and even payment initiators, to communicate in an automated, auditable, and secure way. In practice, this type of tool replaces old paper reports and manual files with instant data transmissions, making the system more dynamic and integrated.

It seems like the perfect, ideal scenario, almost a utopia. However, these bridges are not neutral. Each new channel opening expands the risk surface, as sensitive data can be misused, security incidents can occur, and, given this, the central question arises: who is actually responsible for the damages?

To answer this question, it is necessary to look at the General Data Protection Law (LGPD, Law 13.709/2018), the regulatory norms of the Central Bank of Brazil (BCB), and the recent jurisprudence of the STF and STJ.

Regulatory framework: LGPD and Open Finance

The Open Finance ecosystem emerged from Joint Resolution No. 1/2020, issued by the National Monetary Council (CMN) and the Central Bank of Brazil (BCB), which inaugurated the regulatory framework that allows for the standardization of financial data sharing via APIs between authorized institutions, such as banks, credit unions, direct credit companies, and payment initiators, with the central idea being to stimulate competition and foster innovation in the financial market, but always under criteria of security and governance.

Subsequently, the Central Bank of Brazil (BCB) issued complementary regulations, including Resolution BCB No. 32/2020, which detailed the technical requirements and operational procedures of Open Finance, defining API standards, consent flows, and authorization validity periods. 

Security and Privacy by Design in Open Finance

When discussing data protection in Open Finance, it is impossible to ignore the requirement that the system be designed and operated under the logic of privacy by design, a concept consolidated in Article 46 of the LGPD (Brazilian General Data Protection Law), which mandates that appropriate technical and administrative measures be applied from the conception of products and services, and not only in a corrective manner after incidents occur.

From a technical standpoint, the Central Bank has established quite robust standards: the APIs that support Open Finance must operate with secure authentication protocols, such as OAuth 2.0 and OpenID Connect, in addition to the mandatory use of mTLS (mutual Transport Layer Security), which ensures that both client and server authenticate each other. These requirements directly relate to the principles of security and prevention (article 6, VII and VIII of the LGPD).

It's important to highlight that this isn't just about technology: granular consent is one of the pillars of the system. Consumers must have the freedom to choose which data will be shared (for example: statements, limits, or credit history), with which institution, and for how long. This requirement ensures compliance with Article 8 of the LGPD (Brazilian General Data Protection Law), which requires informed, unequivocal, and specific consent.

A point frequently debated in legal doctrine is the definition of roles between controllers and processors (Article 5, VI and VII, LGPD). A fintech company, for example, may be a mere processor when handling data on behalf of a bank, but if it starts deciding on purposes, it will be considered a controller. Since civil liability in Brazil is joint and several (Article 42, §1, LGPD), any participant in the chain may be held liable in case of incidents.

Therefore, as authors such as Danilo Doneda and Laura Schertel Mendes rightly point out, the principle of privacy by design ceases to be a mere doctrinal recommendation and becomes a regulatory obligation. In Open Finance, it is the dividing line between responsible innovation and exposure to severe legal and financial risks.

Civil liability – LGPD, CDC and case law

Civil liability for incidents involving data in Open Finance rests on a three-pronged normative framework: the LGPD (Brazilian General Data Protection Law), the Consumer Protection Code (CDC), and the jurisprudence of the Superior Court of Justice (STJ).

The first law, in its articles 42 to 45, establishes the objective liability of data processing agents, which does not require proof of fault, only proof of damage and causal link. Furthermore, all participants in the processing can be held jointly and severally liable, allowing the data subject to choose against whom to file the lawsuit. The Consumer Protection Code (CDC), in turn, reinforces this logic by providing, in article 14, for objective liability for the risk of the undertaking.

Recent case law shows evolution. In AREsp 2.130.619/SP (2023), the 2nd Panel of the STJ decided that the leak of common personal data, by itself, does not generate presumed moral damages, requiring proof of concrete harm. 

Given a system with multiple data processing agents, the likelihood of litigation is high; therefore, inter-institutional contracts should include clear liability clauses, audit mechanisms, and cyber risk insurance.

Analyzing the Banco Pan case

A real-world example of the financial sector's vulnerability occurred in January 2021, when Banco Pan suffered a security incident that resulted in the leakage of data from more than 220 customers. Information such as names, CPF numbers (Brazilian tax identification numbers), phone numbers, and credit card details were exposed.

The institution confirmed the incident and notified the National Data Protection Authority (ANPD), in accordance with article 48 of the LGPD (Brazilian General Data Protection Law). Although there were no unauthorized financial transactions, the episode had significant repercussions, such as increased consumer distrust and the opening of regulatory investigations.

This case highlights that, even before the full consolidation of Open Finance, banks already faced concrete risks related to information security. It reinforces the need for preventive measures, incident response plans, and cyber insurance as an integral part of the governance of financial institutions.

Conclusion

The advancement of Open Finance in Brazil represents a structural transformation in the financial system, expanding competition, innovation, and inclusion. However, the same architecture that offers opportunities for service personalization proportionally increases the surface area of ​​risks related to privacy and data protection.

In turn, the Brazilian regulatory framework, comprised of the LGPD (Brazilian General Data Protection Law), the CDC (Consumer Protection Code), and the regulations of the Central Bank, imposes rigorous standards of security, consent, and governance, aligned with the principle of prevention and the duty of transparency. Recent jurisprudence from the STJ (Superior Court of Justice) reveals an interpretative evolution, sometimes requiring proof of concrete damage, sometimes recognizing presumed moral damage in cases of data breaches, which indicates a trend towards strengthening the protection of privacy.

The real-life case of Banco Pan (2021), with the exposure of thousands of customer data, demonstrates that security incidents are not mere academic hypotheses, but concrete facts capable of generating social distrust, reputational repercussions, and potential civil liabilities. Such episodes demonstrate the need for a proactive approach and consistent investments in cybersecurity, regulatory compliance, and insurance against digital risks.

Ultimately, data protection in Open Finance has ceased to be merely a regulatory obligation and has become a condition for the competitiveness and survival of financial institutions. The future of this ecosystem will depend on the ability to transform regulatory guidelines into effective governance and security practices. The central element at stake is trust, a legal and social good that underpins not only the relationships between consumers and institutions, but also the very legitimacy of the digital financial system.