Privacy, Data Protection and Retention
Google Spain SL v. Agencia Española de Protección de Datos
Closed Mixed Outcome
Global Freedom of Expression is an academic initiative and therefore, we encourage you to share and republish excerpts of our content so long as they are not used for commercial purposes and you respect the following policy:
Attribution, copyright, and license information for media used by Global Freedom of Expression is available on our Credits page.
The 10th Civil Court in São Paulo, Brazil held that a state representative who had compiled and shared with the police dossiers of individuals he accused of being “antifascists” had violated the privacy of those individuals. After the state representative had asked his followers on Twitter to share information on people he said were “antifascists” he said that he had collated information on more than 1000 individuals. The information was leaked which included personal information of the individuals concerned. The Court found that even though it was not clear who had leaked the information, the state representative had contributed to the information’s dissemination, and so held that he had harmed and should pay damages to the individuals whose right to privacy had been infringed.
In June 2020, Douglas Garcia Bispo dos Santos, a state representative in São Paulo, Brazil, used his Twitter account to ask his followers to send him information on the full names and “corroborating evidence” of people who were “antifascists”. He claimed these antifascists were responsible for vandalism and other acts in the midst of a May 2020 demonstration and had engaged in “terrorist acts” under criminal law. On Twitter, he boasted he had assembled information on about 1000 individuals. He then forwarded the dossiers to the police. “Antifa dossiers” later circulated on the internet, but Mr Santos denied those were the ones he had prepared, and claimed the leaked material had been circulating prior to his tweets.
A class action was brought by the prosecution services against Garcia before the 10th Civil Court in São Paulo.
On August 2, 2021, Judge Márcio Teixeira Laranjo entered the judgment for the 10th Civil Court. The central issue before the Court was whether Garcia had harmed the individuals included in the dossiers.
The Court explained that the leaked dossiers included home addresses, phone numbers, as well as government identification.
The Court noted that Garcia had admitted that he had prepared dossiers. It found that the assembling of such documents from social media content had “the unequivocal purpose of subsequent dissemination” given that the information was of no use to criminal prosecution, rejecting Garcia’s claim that he had not distributed the documents beyond his referral to the police.
The Court did not make a finding on whether Garcia was responsible for leaking the dossiers, but concluded he had “contributed, albeit indirectly, to the collection and dissemination of data on third parties”. However, the Court rejected Garcia’s argument that no harm had been caused given that the data included in the dossiers were publicly accessible on social media and therefore not private. It held that harm resulted from the fact that such data were reassembled to inflame groups of opposing political opinions against those featured in the dossiers. It also held that the fact that “private data” had been made available by the data subject did not entail that consent had been given for that data to be used by others. As a result, the Court ruled that Garcia had caused harm to those included in the dossiers, in violating their “right to privacy, reputation, and even political freedom and freedom of belief.” The Court dismissed Garcia’s argument that his conduct was protected by legislative immunity, stating the harm did not result from the “opinions, words or votes” for which state representatives are not liable.
The Court entered a declaratory judgment, establishing that Garcia had harmed and should pay damages to those included in the dossiers. It rejected the other remedies sought by the prosecution services which were a monetary judgement of 200,000BRL for non-economic harm caused to society as a whole and an order that the defendant issue a retraction.
Decision Direction indicates whether the decision expands or contracts expression based on an analysis of the case.
This ruling limits the expression of social media users who facilitate the publication of individuals’ personal information online but protects the right to privacy of those individuals, and uses personal data protection and privacy rights to limit how information is made available on social media to the detriment of other social media users.
Global Perspective demonstrates how the court’s decision was influenced by standards from one or many regions.
Case significance refers to how influential the case is and how its significance changes over time.
Let us know if you notice errors or if the case analysis needs revision.