Public Exposure of Alleged Offenders: Legal Boundaries and Corporate Risks

The recent action by Brazil’s National Data Protection Authority (ANPD) in the case involving the retail chain Havan, which released videos of alleged shoplifters in its stores, reignites a central debate in the corporate environment: how to balance the right to personal data protection with legitimate measures to safeguard property.

In a context of growing concern over the physical and legal security of operations, many companies have adopted monitoring technologies and communication strategies to deter illicit practices. However, the way these actions are carried out must comply not only with criminal law but also with data protection regulations and fundamental rights.

The Havan Case and ANPD’s Intervention

In May 2025, the ANPD received a notification from the Public Prosecutor’s Office of Santa Catarina requesting an assessment of whether Havan’s practice of posting videos of people suspected of shoplifting was compatible with the Brazilian General Data Protection Law (LGPD). After a preliminary review, the ANPD issued a preventive measure ordering the temporary suspension of such postings on the company’s social media channels.

The decision was based on key provisions of the LGPD, particularly Articles 6 (principles of data processing), 7 and 11 (rules for personal and sensitive data), 14 (special protection for children’s and adolescents’ data), and 55-J (ANPD’s powers). The main concern was the risk of improperly exposing images of minors, which demands heightened safeguards.

It is important to note that the ANPD’s measure is precautionary, does not impose administrative sanctions, and does not prevent the company from using security cameras or providing evidence of crimes to law enforcement or judicial authorities. The suspension applies exclusively to the public disclosure of images of suspects, without judicial authorization, through communication channels accessible to the general public.

Legal Aspects and Corporate Risks

The case highlights a recurring legal risk: exceeding the legitimate purpose for collecting personal data. Surveillance by cameras in commercial establishments is lawful and widely used, provided principles such as purpose, adequacy, and necessity are respected. However, the public disclosure of such images, even in cases of apparent wrongdoing, may constitute a violation of the LGPD and fundamental rights, especially the right to honor and image protected under Brazil’s Federal Constitution.

For companies, the risks include:

• Administrative liability before the ANPD, with the possibility of future sanctions.

• Civil liability for moral and material damages, including in individual lawsuits.

• Reputational harm, with potential damage to corporate image and relationships with consumers and partners.

An additional aggravating factor is the processing of minors’ personal data, which the LGPD classifies as sensitive, requiring specific consent and enhanced protection.

Best Practices and Preventing Legal Conflicts

Prevention is the safest strategy. Companies should maintain clear security and privacy policies, with internal protocols for handling personal data collected through cameras and other means. When necessary, images should be shared exclusively with competent authorities, maintaining confidentiality and avoiding public exposure without legal backing.

Internal training, preventive legal counsel, and LGPD compliance audits are effective tools for risk reduction. Additionally, corporate communications teams must align with legal guidelines to avoid publishing content that could violate the law.

Corporate Security with Legal Compliance

The Havan case demonstrates that the pursuit of asset protection must go hand in hand with respect for data protection laws and fundamental rights. Beyond being a legal requirement, this approach strengthens corporate credibility and consumer trust.

Companies that invest in preventive legal strategies, with continuous support from specialized attorneys, can mitigate risks and protect their reputation, acting ethically and in full compliance in an increasingly regulated business environment.