<\/p>\n
The progressive technological sophistication has placed classical legal categories under tension, especially those related to the temporal delimitation of the illicit act and the identification of the moment of damage occurrence. In the field of data protection and information security, this tension becomes particularly evident in the face of a scenario that ceases to be merely speculative: the possibility that personal data stolen today, still protected by encryption considered robust according to the state of the art, may become accessible only in the future due to advances in computational capacity, especially quantum computing.<\/p>\n
This hypothesis breaks with the relative simultaneity that has historically characterized information security incidents, in which unauthorized access and potential damage to data subjects occur concomitantly or within a reduced time interval. On the contrary, we now deal with a model of dissociation between access and damage, in which the agent obtains the data at a first moment, without the capacity to exploit it, and only subsequently, with technological evolution, proceeds to use it harmfully. This is, therefore, a phenomenon that can be described as “deferred damage,” whose incorporation into legal reasoning is still incipient.<\/p>\n
Recent technical literature already recognizes this phenomenon under the logic of “harvest now, decrypt later,” according to which malicious agents collect encrypted data today with the expectation that they will become accessible in the future, when there is sufficient computational capacity to break the encryption mechanisms currently used (NIST, 2024). This realization shifts the axis of legal analysis: it is no longer just a matter of assessing unauthorized access at the moment it occurs, but of understanding the potentially prolonged lifecycle of the injury.<\/p>\n
In the scope of Brazilian criminal law, the analysis must start from the rule enshrined in art. 4 of the Penal Code, which adopts the theory of activity by establishing that the time of the crime is that of the action or omission (BRASIL, 1940). In light of this criterion, the improper obtaining of data, for example, through invasion of an IT device, constitutes a consummated crime at the moment of theft, even if the data is encrypted and therefore practically inaccessible. The subsequent breaking of the encryption and use of the data, in turn, tends to be framed as an autonomous typical fact, whose typification will depend on the concrete use made.<\/p>\n
This framework, although consistent with the current criminal dogmatics, produces relevant effects. First, there is a fragmentation of criminal protection, with the splitting of a materially unitary factual chain into legally distinct events. Second, there arises the risk that the crime of obtaining prescribes even before the occurrence of any concrete damage, since, under the terms of art. 111, I, of the Penal Code, the prescription period begins with the consummation of the offense (BRASIL, 1940). The circumstance of the data remaining encrypted does not alter this initial benchmark.<\/p>\n
Beyond the prescription issue, the quantum threat challenges evidentiary law: how to guarantee the immutability and authenticity of digital evidence if quantum systems can reconfigure information states in fractions of seconds? Security algorithms today considered robust, such as RSA and ECC, which underpin digital signatures and chain of custody hashes (Art. 158-A of the CPP), will become vulnerable to a “quantum breaker.” Consequently, the integrity of evidence collected today may be retroactively questioned if the preservation method is not resistant to quantum computing.<\/p>\n
Classical criminal doctrine provides important elements for understanding the problem. The distinction between instantaneous crime, permanent crime, and instantaneous crime with permanent effects, widely developed by authors such as Hungria, Fragoso, Greco, and Nucci, allows delimiting that consummation, as a rule, occurs at the moment of the practice of the type’s core, even if the effects extend over time (GRECO, 2023; NUCCI, 2022). The jurisprudence of the Superior Court of Justice, in cases involving social security fraud, has already addressed an analogous discussion by differentiating the consummation of the offense from its prolonged effects, ruling out, in certain hypotheses, the characterization of permanent crime (STJ, HC 216.555\/RJ; STJ, REsp 1.206.105\/RJ).<\/p>\n
Transported to the context of personal data, this logic leads to the conclusion that the mere retention of encrypted data does not transform the illicit into a permanent crime, nor does it authorize, as a rule, framing as a continued crime, since there is no homogeneous repetition of conduct, but succession of distinct typical cores.<\/p>\n
This scenario reveals a potential mismatch between the temporal structure of criminal law and contemporary technological dynamics. The idea that the criminally relevant injury coincides with the moment of the action becomes less evident when the offensive potential of the conduct depends on technological conditions not yet available. Thus, the need arises to develop interpretive categories capable of dealing with phenomena of deferred harmfulness, without violating the principles of legality and legal security.<\/p>\n
In the field of personal data protection, the normative logic is distinct. The General Data Protection Law structures the obligation to notify security incidents from the existence of relevant risk or damage to data subjects (BRASIL, 2018). The infralegal regulation, in turn, details the criteria for this assessment, emphasizing the contextual analysis of risk and potential impact on fundamental rights (ANPD, 2024).<\/p>\n
The European experience reinforces this approach. The guidelines of the European Data Protection Board establish that the notification obligation depends on the probability of risk to the rights and freedoms of data subjects, with robust encryption being a relevant mitigation factor, insofar as it can make the data unintelligible to unauthorized third parties (EDPB, 2023).<\/p>\n
In this context, the exfiltration of duly encrypted data may, under certain circumstances, not immediately give rise to the notification obligation, if there is no concrete relevant risk. However, the advance of quantum computing challenges this premise by introducing the possibility of future breaking of currently considered secure encryption. Although the current legal framework does not expressly require consideration of future and uncertain technological risks, the accountability principle imposes on data processing agents the duty to continuously review their security measures and reassess risks in light of technological evolution (BRASIL, 2018).<\/p>\n
This duty materializes in the concept of “cryptographic agility mandate,” defined as an organization’s ability to migrate from one cryptographic standard to another quickly and efficiently. From the perspective of the LGPD and accountability, a processing agent’s failure to adopt Post-Quantum Cryptography (PQC) standards, such as those recently finalized by NIST (e.g., ML-KEM and ML-DSA), may in the future be interpreted as a violation of the duty of diligence. Data security ceases to be merely the “ought to be” to become the “duty to demonstrate” continuous effectiveness in the face of technological advances.<\/p>\n
The eventual future breaking of encryption and the consequent access to data in intelligible format would configure, in this sense, a new security incident, distinct from the one initially occurred, with potential materialization of relevant risk or damage to data subjects. This model evidences the existence of layered incidents, in which an initial technical event unfolds into multiple legal consequences over time.<\/p>\n
The urgency of this legal reinterpretation is accentuated by the fact that HNDL targets long-life data, whose value depends on secrecy over generations. Critical examples include health data and genetic information, which never lose their sensitivity, as well as state secrets and industrial intellectual property. For these assets, the “Q Day,” the day of breaking, does not represent the expiration date of protection, but the detonation point of a latent liability collected stealthily today.<\/p>\n
From these premises, the phenomenon is proposed to be understood as an expression of an illicit with temporally biphasic harmfulness. There is, in a first moment, an injury to the structural confidentiality of the data, even without immediate intelligibility; in a second moment, a supervening injury of exploitation occurs, when the information becomes accessible and apt to generate concrete damages. This formulation allows preserving the coherence of criminal law, by recognizing consummation at the moment of the action, without ignoring the material unity of the phenomenon, and, simultaneously, improving regulatory analysis, by admitting the existence of latent risk that may materialize in the future.<\/p>\n
In the final analysis, technological advances, especially in the field of quantum computing, expose structural limits of traditional legal categories. The law begins to face not only the question of when the illicit occurs, but also when the damage becomes intelligible, exploitable, and legally relevant. Temporality thus ceases to be a merely formal element and comes to occupy a central position in the definition of the illicit and the construction of adequate legal responses.<\/p>\n
<\/p>\n
[1]<\/a> NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST). What is Post-Quantum Cryptography? Dispon\u00edvel em: https:\/\/www.nist.gov\/cybersecurity-and-privacy\/what-post-quantum-cryptography. Acesso em: 17 abr. 2026.<\/p>\n [2]<\/a> BRASIL. Decreto-Lei n\u00ba 2.848, de 7 de dezembro de 1940. C\u00f3digo Penal. Dispon\u00edvel em: https:\/\/www.planalto.gov.br\/ccivil_03\/decreto-lei\/del2848.htm. Acesso em: 17 abr. 2026.<\/p>\n [3]<\/a> Id.<\/p>\n [4]<\/a> VALE, Lu\u00eds Manoel Borges do; PEREIRA, Jo\u00e3o Sergio; AMARAL, Samya Suruagy do. Computa\u00e7\u00e3o qu\u00e2ntica e provas judiciais. Migalhas, 25 set. 2025.<\/p>\n [5]<\/a> GRECO, Rog\u00e9rio. Curso de Direito Penal. Rio de Janeiro: Impetus, 2023.<\/p>\n [6]<\/a> NUCCI, Guilherme de Souza. Manual de Direito Penal. Rio de Janeiro: Forense, 2022.<\/p>\n [7]<\/a> SUPERIOR TRIBUNAL DE JUSTI\u00c7A (STJ). HC 216.555\/RJ. Dispon\u00edvel em < https:\/\/www.stj.jus.br\/websecstj\/cgi\/revista\/REJ.cgi\/ITA?seq=1155836&tipo=0&nreg=201101994617&SeqCgrmaSessao=&CodOrgaoJgdr=&dt=20120629&formato=PDF&salvar=false>.<\/p>\n [8]<\/a> SUPERIOR TRIBUNAL DE JUSTI\u00c7A (STJ). REsp 1.206.105\/RJ. Dispon\u00edvel em < https:\/\/www.stj.jus.br\/websecstj\/cgi\/revista\/REJ.cgi\/ITA?seq=1103844&tipo=0&nreg=201001493383&SeqCgrmaSessao=&CodOrgaoJgdr=&dt=20120822&formato=PDF&salvar=false>.<\/p>\n [9]<\/a> BRASIL. Lei n\u00ba 13.709, de 14 de agosto de 2018. Lei Geral de Prote\u00e7\u00e3o de Dados Pessoais. Dispon\u00edvel em: https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm. Acesso em: 17 abr. 2026.<\/p>\n [10]<\/a> AUTORIDADE NACIONAL DE PROTE\u00c7\u00c3O DE DADOS (ANPD). Regulamento de Comunica\u00e7\u00e3o de Incidente de Seguran\u00e7a. Dispon\u00edvel em: https:\/\/www.gov.br\/anpd\/pt-br\/canais_atendimento\/agente-de-tratamento\/comunicado-de-incidente-de-seguranca-cis. Acesso em: 17 abr. 2026.<\/p>\n [11]<\/a> EUROPEAN DATA PROTECTION BOARD (EDPB). Guidelines 9\/2022 on personal data breach notification. Dispon\u00edvel em: https:\/\/www.edpb.europa.eu\/our-work-tools\/documents\/public-consultations\/2022\/guidelines-92022-personal-data-breach_en. Acesso em: 17 abr. 2026.<\/p>\n [12]<\/a> BRASIL. Lei n\u00ba 13.709, de 14 de agosto de 2018. Lei Geral de Prote\u00e7\u00e3o de Dados Pessoais. Dispon\u00edvel em: https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm. Acesso em: 17 abr. 2026.<\/p>\n [13]<\/a> FIPS 203 do NIST (agosto de 2024)<\/p>\n