A responsabilidade civil do Estado por vazamentos de dados sigilosos de banco de dados do CNJ a partir da Lei Geral de Proteção de Dados

Abstract

This monograph analyzes the civil liability of the State in relation to security incidents involving personal data managed by the National Council of Justice (CNJ). It begins by examining the historical development of State liability, from the theory of State irresponsibility to the consolidation of objective liability based on the administrative risk doctrine, as provided for in Article 37, paragraph 6, of the 1988 Federal Constitution. The study then investigates the legal protection of privacy and personal data within the Brazilian legal system, considering its connection with human dignity, personality rights, informational self-determination, and the regulatory framework established by the General Personal Data Protection Law (LGPD). It demonstrates that the CNJ, by coordinating and managing national databases of the Judiciary, acts as a controller of personal data and is therefore subject to the duties of security, prevention, and governance established by the LGPD and by its own institutional regulations. The concentration of procedural, criminal, family-related, property-related, and sensitive information increases the risks associated with unauthorized access and data breaches, requiring a level of protection compatible with the nature and relevance of the data processed. The study concludes that State civil liability in such cases does not arise automatically from the mere occurrence of a security incident. Rather, it depends on the establishment of the legal requirements for the duty to compensate, especially the existence of damage, a causal link, and a failure to comply with the legal duties of protection.