Brazilian Superior Court of Justice Rules That Disclosure of Non-Sensitive Data in Credit Registry Does Not Automatically Trigger Moral Damages

On February 13, 2026, the Fourth Panel of the Brazilian Superior Court of Justice unanimously held that the mere disclosure of non-sensitive personal data within the positive credit registry system does not, in itself, give rise to presumed moral damages. In Special Appeal No. 2,221,650, the Court followed the reporting Justice’s opinion, establishing that compensation depends on evidence of a significant infringement of the data subject’s personality rights. The dispute concerned allegations that personal registration data had been unlawfully commercialized through credit scoring services, in purported violation of the Brazilian General Data Protection Law, the Positive Credit Registry Law and consumer protection rules.

The Court clarified that Article 7 of the General Data Protection Law authorizes the processing of personal data for credit protection purposes, subject to the limits set by the specific legislation governing the positive credit registry, which allows the opening of a credit record without prior consent and the sharing of registration and payment performance data among database managers. The ruling emphasized that, unlike sensitive personal data, the improper disclosure of ordinary personal data does not automatically result in moral damages. Compensation requires proof both of unlawful data disclosure and of actual harm, which was not established in the case, and factual reassessment is barred in special appeals.