GDPR and just cause dismissal: when a data leak can lead to termination

Dismissing an employee for cause over a data protection breach requires evidence, prior rules and proportionality. Here is what HR needs to know, along with employees’ data rights

HR handles personal data every day: salaries, ID documents, health information and dependents. When an employee exposes that data, whether by carelessness or on purpose, the question is unavoidable: can you terminate for cause? The answer is “it depends,” and a hasty decision can be overturned by the labor courts.

For a foreign headquarters, the risk is concrete: a poorly supported dismissal and a data incident under Brazil’s GDPR-equivalent law (LGPD) can add up to labor liabilities and regulatory exposure for the local subsidiary.

A data leak does not automatically justify dismissal for cause

For a just cause dismissal to hold, the conduct must fall under the situations listed in Article 482 of the CLT (Brazil’s Labor Code), such as misconduct or breach of company confidentiality, and the employer must prove what happened. Suspicion is not enough. In their analysis, judges usually consider:

• the seriousness of the offense and the extent of the damage;

• the employee’s intent or negligence;

• the employee’s prior knowledge of company rules;

• the proportionality of the penalty and how promptly the company reacted.

A real case

In a ruling from the São Paulo labor court (TRT-2), a just cause dismissal was upheld for an assistant who mistakenly emailed a file containing the names, salaries, FGTS (severance fund) and PIS (social integration program) data of more than 350 employees. The judge found that the employee knew the data handling rules and that she had breached the Code of Ethics and the Information Security Policy. According to the ruling, the absence of financial loss does not reduce the seriousness of the conduct. Each case is assessed individually, however, and the outcome is not automatically repeated.

What the company needs in place before an incident

• A clear information security policy, with rules on devices, personal email and cloud storage.

• Periodic training, with documented employee acknowledgment.

• Signed confidentiality agreements.

• Access controls and logs kept in a legally appropriate way.

• An investigation procedure that preserves digital evidence.

• Coordination between HR, Legal and IT.

Policies created only after an incident weaken the defense. Indiscriminate monitoring or access to personal content without proper grounds can invalidate the evidence.

What about employees’ rights?

LGPD works both ways. Companies must also protect their own employees’ data and guarantee their rights as data subjects, such as confirming that their data is being processed, accessing and correcting it, and being informed about how it is used. Failures in protecting employee data can aggravate the company’s position in a dispute.

Conclusion

Just cause dismissal for LGPD violations is possible, but it depends on preparation. Companies with clear rules, documented training and well-collected evidence reduce the risk of reversal and of labor liabilities. Each case should be reviewed by legal counsel before the dismissal.

Source: TRT-2 (via Migalhas) and Pallotta Martins Advogados | Adaptation and review: DBS Partner Team

Employee data moves constantly through payroll and HR routines, and protecting it takes secure processes. DBS Partner runs your company’s payroll and HR routines with a focus on confidentiality and compliance. Get in touch with our team and find out how we can support your company’s HR. Email us at dbs@dbspartner.com.br.