Brazilian consumer association files action against facebook for data breach

As a result of the scandals involving personal data and behavioral profiles breaches regarding 87 million users connected to Facebook, disclosed to the consulting firm Cambridge Analytica for marketing and political purposes, the SOS Consumer Association filed, in April, 2018 a public civil action against the social media in Brazil, for the violation of diffuse and collective rights, as the right to privacy.

According to the Association, Facebook would be responsible for the breach of data, information and behavioral profiles of 443 thousand Brazilian users. Also, due to the worldwide impact of the accusations against the site and the testimonies already performed by the founder and legal representative of the company, Mark Zuckerberg had already admitted, before the US Congress, the responsibility for his mistake about the disclosure of information. In this scenario, Mark would have apologized for the episode, claiming responsibility for not ensuring sufficient protection to the data of its users and to the damages caused.

The plaintiff also calls attention to the application of the Consumer’ Protection Code to the services offered by hosting providers (as is the case of Facebook), even if they are free of charge directly by the user. Once the compensation happens through advertising on the website and, according to the plaintiff, also through the sale of personal data and behavioral monitoring information, it would be evident the profit generated by virtue of its users and, therefore, the application of the Consumer’s Code.

With the lawsuit, currently in the 7th Civil Court of the Central Forum of the Capital of São Paulo, the Association expects to obtain payment of compensation for collective moral damages, for which the value should be reverted to the Fund for the Defense of Diffuse Rights (“FDD”). In this sense, the requested amount is required as a corrective measure, in order to punish the social network and constrain it in future practices of personal data violation, that is, in the function of discouragement. The request is also grounded in the high income of Facebook, currently around 1.5 billion Reais. Therefore, the Association points out that the values to be arbitrated by the court shall correspond to the profit of the company, so that it can actually impact the company and take any effect.

On May 25, 2018 Facebook Brasil presented its defense, in which, among other arguments, stresses that there was no system invasion or data breach, as well as the data have been obtained from the use of the application of a third party, in which the users had the option to consent or not to the mentioned data collection.

Despite arguing that the improper transfer of data has been performed by this third party to Cambridge Analytica, the action remains pending consideration and ruling from the competent judge.

In case of any doubts about this subject, please do not hesitate to contact us.

KEY CONTACT:
Paula Mena Barreto
Partner
T: +55 21 3262-3028
E: paula.menabarreto@cmalaw.com