Responsabilidade civil no incidente de compartilhamento indevido de dados pessoais em plataformas digitais à luz da Lei Geral de Proteção De Dados (lei no 13.70918): análise do caso Facebook

Abstract

This study aims to analyze the civil liability of digital platforms in cases of unauthorized sharing of personal data, under the General Data Protection Law (Law No. 13.709/18), using the Facebook–Cambridge Analytica scandal as a case study. Widely reported by international media, the case revealed that the social network allowed, through an external application, access to the data of up to 87 million users without their informed and specific consent. In Brazil, approximately 443,000 users were affected, which led to the opening of an administrative proceeding by the Consumer Protection Department (DPDC), even before the LGPD came into force. Based on a bibliographic review and documentary analysis, the research shows that Facebook violated several core principles of the LGPD, such as purpose limitation, necessity, transparency, and security. The platform's conduct, by allowing third-party access to user data and their contacts without effective oversight, constitutes a serious infringement of the fundamental rights to privacy and data protection. Moreover, the absence of preventive measures and prompt notification to users and authorities increases the company’s legal liability. The legal analysis demonstrates that the LGPD establishes effective mechanisms for civil liability, enabling data subjects to seek compensation for moral and material damages, in addition to the imposition of administrative sanctions by the Brazilian National Data Protection Authority (ANPD). The case emphasizes the importance of joint liability among data processing agents and the need for stricter control over external operators. It also underscores the role of ANPD in monitoring compliance and fostering a culture of data protection in Brazil. It is concluded that Facebook’s liability is legally justified and socially necessary to ensure the effectiveness of the LGPD and safeguard data subjects in an increasingly vulnerable digital environment. The study reaffirms the importance of data governance policies, legitimate consent, and transparency as central elements for preserving human dignity and digital citizenship.