There is much debate regarding civil liability under the LGPD. Is the civil liability established in Law No. 13.709/18 strict or fault-based? If it is considered strict liability, would the basis for liability refer to the risk inherent in the activity (due to its performance—Art. 42) or to a defect in the product or service (improper processing—Art. 44)? If liability is deemed subjective, is fault assumed as the attributive factor, or will we rely on an objective concept of wrongdoing? If so, would the elimination of fault preclude subjective liability (as in France), or is a genuine objective obligation to compensate only established when we set aside the concept of wrongdoing, as in the legislation of Germany or Portugal?
This debate is important—as are the various solutions developed thus far—but it does not exhaust the multiple variables and dimensions of the term “liability” and its possible applications under the LGPD. In fact, the controversy over the exact basis for attributing civil liability concerns solely the characterization of the obligation to compensate, so that full reparation for pecuniary and non-pecuniary damages may be transferred from the victim’s sphere to the assets of the parties causing the damages.
In common law, there is a term that perfectly fits the classical civil law sense of liability: “liability.” Various theories address liability in the context of civil liability. In common, they refer to compensation whose core consists of a causal link between conduct and harm, supplemented by other elements depending on the specific basis for attribution, taking into account the particularities of each jurisdiction.
However, this is only one of the meanings of “responsibility.” Alongside it are three other terms: “responsibility,” “accountability,” and “answerability.” All three can be directly translated into Portuguese as “responsibility,” but in fact they differ from the exclusive meaning that civil law jurisdictions attribute to “liability,” as the central focus of civil liability (Articles 927–954 of the Civil Code). What these three terms have in common is that they transcend the judicial function of redressing damages, adding new layers to responsibility that are capable of responding to the complexity and speed of social arrangements.
We believe it is important to emphasize the meaning of each of the terms used in the English language in order to broaden the concept of responsibility. Words often serve as frameworks for understanding meaning, and the polysemy of “responsibility” helps us escape the monopoly of the compensatory function of civil liability, as if it were limited to the payment of a sum of money capable of restoring the injured party to their pre-damage situation. Liability is not the epicenter of civil liability, but merely its outer layer. In truth, it is merely a last resort for what is expected of civil liability in the 21st century, particularly in the protection of personal data.
Starting with “responsibility,” this refers to the moral sense of responsibility—voluntarily accepted and never legally imposed. It is a forward-looking concept of responsibility, in which responsibility becomes an instrument for self-governance and the shaping of life. In the field of personal data processing, it takes on two aspects: for processing agents, it means incorporating ethics into the exercise of their activities; for data subjects, it means digital education, in the sense of “…training, integrated with other educational practices, for the safe, conscious, and responsible use of the internet as a tool for the exercise of citizenship” (Art. 26 MCI). If a person does not know what happens to their data, they cannot protect themselves. Concepts such as “data anonymization” are not even fully understood by lawyers, let alone by the general public. For this reason, digital education should not be confused with the fundamental right to digital inclusion (discussed in this space in the October 23 column by Carlos Edison do Rêgo and Diana Loureiro). Digital education goes beyond the idea of internet access, encompassing the concept of informational self-determination, as outlined among the principles of the LGPD (Art. 2, II, Law 13.709/18).
Moving on to “accountability,” we broaden the scope of responsibility by including preventive regulatory parameters that foster an interaction between the liability provisions of the Civil Code and regulations focused on data governance, whether on an ex ante or ex post basis.
At the ex ante level, accountability is understood as a guide for data controllers and processors—the key actors in the processing of personal data—through the incorporation of best-practice rules that establish procedures, security standards, and technical standards, as set forth in Article 50 of the LGPD. Compliance is essential as a means of planning for risks with the greatest negative impact. It is for this very reason that, when discussing the principles of data processing, Article 6 of Law 13.709/18 refers to “liability and accountability.” In fact, when addressing data protection impact assessments from a human rights perspective, the European Union’s GDPR broadens the scope of accountability so that stakeholders are informed about operations that infringe upon the free development of the individual, cause discrimination, or violate dignity and the exercise of citizenship.
On the ex post side, accountability serves as a guide for judges and other authorities, both to identify and quantify liabilities and to establish the most appropriate remedies. Thus, rather than having the judge rely on discretion to assess the intrinsic risk of a certain activity due to its high potential for harm —the disincentive to entrepreneurship is the reaction of economic agents to legal uncertainty—standards and instrumental safeguards are established that serve as objective parameters for measuring risk in comparison with other activities. Moreover, if the party causing the harm has effectively invested in compliance, a reduction in damages may even be considered as a form of reward-based sanction, pursuant to the sole paragraph of Article 944 of the Civil Code. Furthermore, the absence of a legal provision for a legal model similar to punitive damages does not prevent the National Data Protection Authority, in response to violations committed by processing agents, from using accountability to impose punitive sanctions and determine the amount of fines, as provided for in Article 52 of the LGPD.
One cannot rule out the possibility that, in response to the prospect of liability compounded by accountability, economic actors will respond to the combined efforts of legislation and regulation by standardizing contractual arrangements designed to spread the costs of incidents. The use of contractual risk management may take the form of limiting liability or transferring it to the user or to insurance companies. However, we must not overlook the information asymmetry faced by users—often in their capacity as consumers—when it comes to rigorously assessing general contractual clauses.
Finally, we enter the realm of answerability. The term is literally translated as “explainability,” establishing itself as yet another layer of the preventive function of responsibility. Answerability is a process of justifying decisions that goes beyond the right to information, facilitating an understanding of the entire context of data processing operations. Under the LGPD, it broadens its scope, becoming an “ability to appeal”; that is, the data subject has the right to request a review of decisions made solely on the basis of automated processing of personal data that affect their interests, including decisions intended to define their personal, professional, consumer, and credit profiles or aspects of their personality (Art. 20, Law 13.709/18). Priority is given to an extrajudicial review by humans of decisions produced by artificial intelligence. Liability will arise at a later stage if damages eventually occur due to harmful acts or activities that violate a person’s profiling or reach existential situations.
Responsibility, accountability, and answerability exemplarily fulfill the preventive and precautionary functions of civil liability, which may be complemented by the compensatory function (liability). Contrary to what the classical school of liability propagates, the preventive effect is distinguished from a mere side effect of a judgment awarding damages. In fact, the multifunctionality of civil liability is not limited to an academic discussion: the pluralistic perspective on its applicability to the LGPD is a well-developed legislative example of the need to broaden our understanding of civil liability. It is not merely a mechanism for limiting damages, but also for curbing certain behaviors. We have moved beyond “tort law” and arrived at a concept of civil liability that extends far beyond damages.
This highlights a renewed, two-pronged perspective: liability as a mechanism for attributing damages—the focus of reparatory analysis—in which the agent is held liable “toward” the victim, coexists with liability “for the other,” the human being. Here, the person of the agent is integrated with the promotion of compliance through risk management regulations—particularly risk mitigation—whether on the part of a developer of emerging digital technologies or a processing agent (accountability/answerability). However, in a spirit of reciprocity, the mitigation of unlawful acts and harm also falls to each of us, through the gradual development of responsible self-determination that frees us from heteronomy and victimization (responsibility), for, as Isaiah Berlin once observed, “Paternalism is the worst form of oppression.”
Article originally published on November 6, 2020