Why is this news now?
In recent months, the term "criminal review" made headlines when government agencies had to redo investigations because data was compromised or misused on digital platforms. Here's what most people don't realize: you could be involved in a digital court case without even knowing how your data is being handled.
If you've ever emailed a document to a lawyer, uploaded a photo of your ID to a banking app, shared conversations on WhatsApp with someone, or were mentioned in an online case, your data is out there. And the question that should keep you up at night is: who has access to it? How is it protected?
🚀 Need this built for you?
I build sites, systems, AI and automation — let's talk.
Talk to Adriano Soluções →What really happens with your data in a criminal case
A digital court case isn't like a piece of paper stored in a yellow folder in a public archive. In reality, your data passes through multiple systems: case management systems (those portals lawyers use), emails, government servers, videoconference platforms for hearings, and sometimes even Dropbox or Google Drive—yes, even in courtrooms.
Each of these points is a potential opening. A misconfigured server, a weak password shared between three employees, a hacked webcam during a virtual hearing—anything can leak your data.
The real problem is the lack of standardization. There's no "universal security protocol" that all courts follow. One court in São Paulo uses one system, another in Minas uses something completely different. Some are outdated, slow, and as insecure as leaving your wallet open at a train station.
What data of yours is at risk?
Everything. Literally everything.
Social security number, date of birth, address, phone number, bank account, financial transaction history (if it's fraud), IP address, photos, videos of you talking, personal documents, private conversations—all of this can be in a digital criminal case.
And here's the worst part: once data enters a legal case, it's virtually impossible to remove. Until the legal storage deadline passes (which can be years), it stays there. If the server gets hacked, that data leaks to the dark web. If a corrupt employee sells access, your information becomes currency.
Your data in a digital case can remain accessible for decades, even after you win the case.
Signs that something is wrong with your data in a case
You don't always know there's been a breach. But some signs are clear:
- You received a call from someone who knows details about your life that only appeared in the case. The person shouldn't know about it, but they do.
- You started receiving emails from "debt collectors" or scammers mentioning specific data you shared during a hearing. Someone sold the information.
- Your social security number appeared on public data lookup websites with information from the case. There are platforms that aggregate case data and sell it to third parties.
- A lawyer or intermediary asked for more data than necessary. Some ask for access to your email or social media "to build your defense"—be suspicious.
- The hearing was by videoconference and you didn't receive an explanation of which platform was used or how the data would be deleted.
What to do now to protect yourself
If you're involved in a criminal case that will be digital
First thing: talk to your lawyer about data security. It's not weird to ask. A good lawyer knows how to protect your information and will be able to answer. If he says "don't worry, it's all secure" without detail, find a new lawyer.
Second thing: never send sensitive documents via regular email. Use platforms with end-to-end encryption. If the court requires email, ask them to confirm if their server is secure. It might seem paranoid, but it's not.
Third: before any virtual hearing, demand to know which platform will be used. Zoom? Google Meet? An internal court system? Ask your lawyer to test the connection beforehand. And during the hearing, minimize what's behind you in the video—yes, people take screenshots.
Fourth: ask the court, in writing, for a copy of all documentation that will be used in the case. You have the right to this. Review everything. If there's incorrect or unnecessary data, notify and request removal before the case advances.
If you suspect your data has been leaked
File a police report. Specifically about the data breach from the case. This creates an official record and speeds up investigations.
Place a credit freeze on your social security number (you can do this for free at credit protection agencies like Serasa and Boa Vista). That way, no one can open an account or take out a loan in your name without your password.
Monitor your bank and credit card accounts for 2-3 months. If you notice unusual transactions, notify your bank immediately.
If the breach involves identity theft (someone opened an account in your name), notify the Federal Police. They have a specific department for digital crimes.
Simple technical protections that work
Use a unique, strong password for each account related to your case (lawyer's email, court portals, videoconferences). Don't reuse that password from 2015.
Enable two-factor authentication (that code you receive on your phone) on all case-related access. Yes, it's annoying. It works even better.
If you use apps to store case documents (Google Drive, OneDrive), check sharing permissions. Don't accidentally leave it "open access." Always specify exactly who can see what.
Don't use public WiFi to access court portals. Use mobile data with a VPN (apps like Proton VPN or NordVPN have a decent free version). It sounds paranoid, but coffee shop WiFi is hackers' favorite place to steal data.
What the court should do (and often doesn't)
Here's an uncomfortable truth: most courts don't have adequate security infrastructure. Not out of malice—from lack of investment and sometimes from lack of knowledge itself.
Digital criminal cases should have: encrypted servers, access restricted only to interested parties, logs of who accessed what and when, automatic data deletion after the legal deadline, and periodic security audits.
Spoiler: they often don't.
If you're a victim of a data breach from a court case, you have the right to compensation for emotional damages. There are laws like the GDPR equivalent (General Data Protection Law) that require public agencies to protect your data. If they don't, you can sue.
The next step: be proactive
If you're entering a criminal case that will have digital components, don't leave your data security to the last minute. Talk to your lawyer about security at your first meeting. Demand documentation of how your data will be protected. If you can't get clear answers, escalate with the court or contact the National Justice Council (CNJ) to complain about lack of security.
And yes, this will take time and energy. But when you see your data circulating freely on the internet years later, or when a criminal uses your information from the case for a scam, it's too late.
Digital criminal review is still new to most courts. But you don't have to be a victim of their lack of preparation. Protect your data. Now.