Public Exposure of Alleged Offenders: Legal Limits and Risks for Companies

The recent action taken by Brazil's National Data Protection Authority (ANPD) in the case involving the retail chain Havan, which published videos of alleged shoplifters in its stores, reignites a central debate in the business environment: how to balance the right to personal data protection with legitimate asset security measures.

Amid growing concern over the physical and legal security of business operations, many companies have adopted monitoring technologies and communication strategies to deter unlawful practices. However, the way these actions are carried out must align not only with criminal law but also with data protection standards and fundamental rights.

The Havan Case and the ANPD's Intervention

In May 2025, the ANPD received a notification from the Santa Catarina State Prosecutor's Office (Ministério Público de Santa Catarina) requesting an analysis of whether Havan's practice of publishing videos of individuals suspected of stealing products in its stores was compatible with the General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or LGPD). After a preliminary review, a precautionary measure was issued ordering the temporary suspension of such disclosures on the company's social media channels.

The decision was based on core provisions of the LGPD, particularly Article 6 (principles governing data processing), Articles 7 and 11 (rules on personal and sensitive data), Article 14 (special protection for children's and adolescents' data), and Article 55-J (ANPD's powers). The main concern was the risk of improper exposure of images of children and adolescents, a situation that demands heightened caution.

It is important to note that the ANPD's measure is precautionary in nature, with no administrative sanctions applied, and it does not prevent the company from using security cameras or sharing evidence of crimes with police or judicial authorities. The suspension applies exclusively to the public disclosure, without judicial authorization, of images of suspects on communication channels accessible to the general public.

Legal Aspects and Risks for Companies

This case illustrates a recurring legal risk: exceeding the legitimate purpose for which personal data was collected. Camera-based monitoring in commercial establishments is lawful and widely used, provided that principles such as purpose limitation, adequacy, and necessity are respected. However, publicly disclosing such images, even in cases of a crime caught in the act (flagrante delito), may constitute a violation of the LGPD and of fundamental rights, particularly the rights to honor and image protected under the Federal Constitution.

For companies, the risks include:

Administrative liability before the ANPD, with the possibility of future sanctions.

Civil liability for moral and material damages, including through individual lawsuits.

Reputational impact, with potential harm to corporate image and relationships with consumers and partners.

There is also the aggravating factor of processing data belonging to children and adolescents, which the LGPD treats with heightened sensitivity, requiring specific consent and reinforced protection.

Best Practices and Prevention of Legal Disputes

Prevention is the safest strategy. Companies should maintain clear security and privacy policies, with internal protocols for handling personal data obtained through cameras and other means. When necessary, footage should be shared exclusively with competent authorities, preserving confidentiality and avoiding public exposure without legal backing.

Internal training, preventive legal counsel, and LGPD compliance audits are effective tools for reducing risk. In addition, it is essential that the corporate communications department be aligned with legal guidelines, avoiding the publication of content that could violate the law.

Corporate Security with Legal Compliance

The Havan episode shows that the pursuit of asset protection must go hand in hand with respect for data protection laws and fundamental rights. More than a regulatory requirement, this approach strengthens a company's credibility and consumer trust.

Companies that invest in preventive legal security, with ongoing support from specialized attorneys, are able to mitigate risks and preserve their reputation, operating ethically and in a legally sound manner in an increasingly regulated business environment.