The General Data Protection Law (LGPD), Law No. 13.709/2018, which came into effect in 2020, established stringent rules for handling of personal data, granting citizens more control over their information. However, at the time of its enactment, there was uncertainty about the judiciary’s interpretation of the law and the time it would take for cases invoking rights arising from violations or non-compliance with the legislation to begin appearing in courts.
In 2021, one year after coming into force, judicial decisions citing provisions of the LGPD were no more than 274, according to a study conducted by the Brazilian Institute of Education, Development, and Research (IDP) and Jusbrasil, titled “LGPD Panel in the Courts,” developed with support from the United Nations Development Programme (UNDP).
These figures reflected low adherence to the legislation and a lack of awareness of its content, even among data owners. However, with the growing relevance of privacy and data protection in Brazil as well as companies’ compliance with the law, between 2022 and 2023, there was a notable increase of 81.4% in judicial decisions related to the LGPD, rising from 665 to 1,206 decisions
The Panel also reveals that among the courts studied in the research, the São Paulo State Court of Justice has the most significant decisions in which the central theme is the LGPD, totaling 81 decisions.
The study further suggests that, in general, the main areas related to cases involving the legislation in the courts are consumer law, civil law, and labor law. The majority of the documents in which the LGPD is cited are appellate decisions, that is, second-instance rulings, comprising 91.2% of the analyzed documents.
This increase in judicial decisions highlights that the LGPD is becoming increasingly effective. There is a growing awareness among data owners regarding their rights, as well as an emphasis on the maturity of the Brazilian legal system in dealing with data protection issues.
In light of the growing strength of the LGPD, it is expected that the number of lawsuits will continue to rise, encouraging organizations to reinforce privacy and data protection practices and to enhance compliance with current legislation.
