The General Data Protection Law (LGPD – Law 13.709/2018) marked a watershed moment in the regulation of information processing in Brazil.
For law students and professionals, understanding this legal microsystem is essential, since personal data has become both the greatest economic asset and the greatest operational risk today.
The legal landscape was transformed by Constitutional Amendment No. 115/2022, which elevated the protection and processing of data to the level of a fundamental right, included in the list of Article 5 of the Constitution (item LXXIX).
The change opened a new chapter in the protection of informational self-determination, that is, the right of the data subject to know and control the fate of their own information.
In this environment of strong regulatory oversight, data leaks generate enormous legal uncertainty, especially for public managers and private companies that handle large volumes of information.
The practical question then arises: if a data breach occurs due to an external attack (such as a hacker intrusion ), can the data controller invoke the exclusive fault of a third party to exempt itself from liability?
The Superior Court of Justice (STJ), through its 3rd Panel, addressed this issue in the judgment of REsp 2.147.374/SP. That's what we'll be discussing in this article!
The rejection of the exclusive fault of a third party.
The case originated from a lawsuit filed against Eletropaulo (now Enel) following a cyber incident that exposed non-sensitive personal data of customers, such as name, ID, CPF (Brazilian tax identification number), address, and telephone number.
The company's defense relied on article 43, III, of the LGPD (Brazilian General Data Protection Law), arguing that the damage resulted from the exclusive fault of a third party (the hacker ).
However, the Superior Court of Justice (STJ) rejected the argument.
According to the rapporteur, Minister Ricardo Villas Bôas Cueva, it was up to the company, as the data processing agent, to prove that it had adopted all the security measures required by the LGPD (Brazilian General Data Protection Law). Only then could it break the causal link. The absence of this robust proof prevented the recognition of the exclusion clause.
The logic is similar to that adopted in the financial sector; just as banks are objectively liable for third-party fraud (STJ Precedent 479), data managers must also assume that security incidents are an inherent risk of the activity.
The concept of "proactive civil liability"
The ruling reinforces that civil liability under the LGPD (Brazilian General Data Protection Law) is guided by a logic of risk and trust. Failure to fulfill the duty of security constitutes irregular data processing.
The decision adopts the notion of "legitimate expectation of protection," considering the processing irregular when the data subject does not receive the security that they could reasonably expect, given the techniques available at the time (article 44, III, of the LGPD).
This understanding embodies the principle of accountability (Article 6, XVII).
The system, which doctrine calls proactive civil liability, requires more than just formal compliance with the law: it demands proof of the effectiveness of compliance programs.
Therefore, it is not enough for a company to claim that it adopts good practices; it must demonstrate through documentation that effective risk prevention, supervision, and mitigation measures have been implemented (article 46 of the LGPD).
In this case, the burden of proof falls on the controller or operator.
The duty of objective security and data distinction
In practice, civil liability for property or moral damages resulting from data breaches is objective.
This rule finds a parallel in the Consumer Protection Code (article 14), according to which the supplier is liable for failures in the provision of the service regardless of fault.
Furthermore, the LGPD (Brazilian General Data Protection Law) allows the judge to reverse the burden of proof in favor of the data subject (art. 42, § 2), reinforcing their position of vulnerability.
In the case of REsp 2.147.374/SP, the data in question was not sensitive.
The São Paulo Court of Justice (TJSP) had required proof of concrete harm to establish moral damages.
However, the Superior Court of Justice (STJ) has already consolidated a more severe position in cases involving sensitive data. In REsp 2.121.904/SP, it held that moral damages are presumed in cases of exposure of highly vulnerable information, such as that from life insurance contracts.
The trend, however, is for the focus of data protection to shift from the content of the data to the possibilities and purposes of its processing.
Ultimately, any data breach compromises informational self-determination and the trust placed in the data controller.
Duty of immediate transparency
The Superior Court of Justice (STJ) did not limit itself to recognizing the company's responsibility.
Furthermore, in REsp 2.147.374/SP, the convictions regarding the obligation to act were upheld, ensuring the rights of transparency and access of the data subject.
The defendant was forced to:
- Inform all public and private entities with which data has been shared (art. 18, VII).
- Provide a complete statement regarding the origin of the data, the purpose of the processing, and a full copy of the information relating to the data subject (art. 19, II).
This measure embodies the principle of transparency (Article 6, XIII), reaffirming that, even before compensation, the data subject has the right to know exactly where their information is being used.
Career opportunities: from theory to market practice
For private law firms, mastering the LGPD (Brazilian General Data Protection Law) opens doors for offices that provide preventive consulting, strategic litigation, and digital due diligence in corporate and contractual transactions.
Increasingly, companies are seeking lawyers capable of developing internal policies, structuring data governance programs, and representing clients in litigation involving data breaches and misuse.
In the corporate sector, there is a growing demand for professionals who can fill positions such as Data Protection Officer (DPO), privacy compliance officer, or digital risk manager.
Legal knowledge combined with technological skills is now a competitive advantage, especially in regulated markets such as healthcare, finance, telecommunications, and energy.
In the public sector, the LGPD (Brazilian General Data Protection Law) requires government agencies to adopt transparent data processing practices, opening up career opportunities in legislative advisory offices, regulatory agencies, and public prosecutor's offices, where the challenge is to reconcile the public interest with the fundamental right to privacy.
There are also opportunities in the academic and research field, with the expansion of lines of investigation into digital rights, artificial intelligence, and platform regulation.
Universities and research centers are demanding legal professionals capable of devising innovative solutions to problems such as misinformation, algorithmic biases, and the impact of AI on the judicial process.
The IDP's postgraduate course in Digital Law, Data, and Artificial Intelligence prepares professionals to navigate all these areas, covering topics ranging from constitutional foundations and the Brazilian Civil Rights Framework for the Internet to compliance practices under the LGPD (Brazilian General Data Protection Law), international data jurisdiction, and regulation of digital platforms.
With an excellent faculty comprised of ministers, renowned lawyers, professors, and specialists who work directly in the market, IDP provides students not only with technical knowledge but also valuable networking opportunities and qualified entry into the job market.
The message is clear: the next decade will be marked by legal and political disputes surrounding privacy, transparency, and artificial intelligence.
Being prepared means being one step ahead, able to transform regulatory challenges into competitive advantages and build a prestigious career.
Whether in the office, at the company, or in academia, the time to take a stand is now.
Professionals who invest in the right knowledge will be remembered as leaders in Digital Law and Privacy, not just as those who witnessed the revolution, but as those who led it.
Want to delve deeper?
Three essential readings in Digital Law:
Guilherme Magalhães Martins & João Victor Rozatti Longhi, Digital Law: Private Law and the Internet – 6th ed. (2025): Up-to-date and comprehensive, it addresses the main legal challenges of the internet and private regulation in the digital environment.
Tarcisio Teixeira, Digital Law and Electronic Process – 9th ed. (2025): Essential for understanding the impact of electronic processes and technology on forensic practices.
Landolfo Andrade de Souza & Américo Ribeiro Magro, Manual of Digital Law – 5th ed. (2025): Didactic and direct, it serves as a practical guide for professionals and students who want to understand the basics of the subject.
