The case judged by the Court of Justice of São Paulo (TJ-SP) determined that there was a leak of the patient's sensitive data by the laboratory and condemned it on July 21st. Understand the case.

According to the case file, a few days after suffering a miscarriage, the woman received a WhatsApp message from a cryobiology laboratory offering a service to collect the umbilical cord that had been removed. The issue is that the woman claims she did not provide her personal information or her pregnancy status to the laboratory.

The laboratory, however, reportedly stated that it only used personal data non-sensitive and non-confidential, a fact that was contested by the court, which found that Pregnancy, as a patient's health condition, could not be identified solely from simple personal data. such as phone number and full name.

Leak of sensitive data resulted in compensation.

According to Article 5 of the LGPD (Brazilian General Data Protection Law), sensitive data can be categorized as:

“II – sensitive personal data: personal data concerning racial or ethnic origin, religious beliefs, political opinions, membership of a trade union or religious, philosophical or political organization, data concerning health or sex life, genetic or biometric data, when linked to a natural person.”

Alexandre Marcondes, judge and rapporteur of the judicial process, said: "Although the defendant claims that it used non-sensitive and non-confidential data, relating only to the plaintiff's name and cell phone number, this is not what can be inferred from the facts presented. The plaintiff was pregnant. This information is data that was used by the defendant in its business activity: acquiring new clients."

This case brought to light how healthcare facilities handle their patients' personal data, and decisions like these help reinforce the importance of law enforcement to ensure greater security for data subjects, who are the most affected in situations like these.

“With this, the responsibility of companies has increased, as they cannot allow the leakage and improper sharing of data. That is why the LGPD (Brazilian General Data Protection Law) plays such an important role. This case will serve as a lesson for all companies, which need to invest in cybersecurity and the confidentiality of information. There is no doubt that we will see more decisions in this regard going forward.”"said Luiz Augusto D'Urso, a lawyer specializing in Digital Law who is also president of the National Cybercrime Commission of the Brazilian Association of Criminal Lawyers (Abracrim)."

The court determined that there had been a leak of the patient's sensitive personal data and ordered the laboratory to pay R$ 10 in compensation to the affected party.

“In accordance with article 42 of the aforementioned legal instrument, the defendant is therefore liable for the improper use of sensitive data which undoubtedly caused the plaintiff moral damages, since at the time of the contact made by the defendant, the plaintiff was no longer pregnant. And the defendant's conduct, in addition to representing a violation of the right to privacy, undoubtedly made the plaintiff relive the suffering of the pregnancy loss.” Marcondes concludes.