CPF at checkout: pharmacies will have to explain how they use customer data

Report from UOL addressed the issue surrounding the use of customers' personal data by pharmacies, which often make the granting of a discount conditional on the presentation of the consumer's CPF. Dr. Matheus Puppe, partner in the TMT, Privacy & Data Protection area at Maneira Advogados, was interviewed to comment on the matter.

CPF at checkout: pharmacies will have to explain how they use customer data

Simone Machado
Collaboration for Tilt*, in São José do Rio Preto (SP)

(Image: Rafael Hupsel/Folhapress)

Requesting the CPF at the pharmacy checkout to finalize a purchase is in the sights of the ANPD (National Data Protection Authority). After analyzing how the pharmaceutical sector has been using consumers' personal data in connection with discounts on medicines, the agency issued a technical note with warnings about the practice.

According to the ANPD, its study shows that:

• Personal data (general examples: name, CPF, address) were being used for purposes other than those indicated to the holders – which is contrary to LGPD (General Data Protection Law).
• There is evidence of excessive collection of personal data, including sensitive personal data (those that help identify a person; such as biometrics), without clear information about how this information is treated (from collection, through use, storage, protection and deletion).
• There is a lack of transparency regarding data sharing with service providers and other commercial partners (such as those responsible for loyalty programs).
• Lack of information and freedom for data subjects.
• Low protection of privacy and personal data in the pharmaceutical sector, harming the holders’ right to information.

WHAT WILL THE ANPD DO?

After the study, and seeking to protect customer data, the ANPD states that it is in contact with associations that represent the pharmaceutical sector. The objective involves:

• Understand the personal data operations carried out by companies
• Ask for improvements in relation to the problems highlighted in the survey.

“The Board of Directors of the ANPD determined, on May 3, 2023, the establishment of an inspection procedure by the General Coordination of Inspection (CGF) and the analysis of the limits of consent as a legal hypothesis in the granting of discounts by the sector, especially in loyalty programs, in cooperation with the National Consumer Secretariat”, says the body in a note, released on the 12th.

WHEN CAN THE PHARMACY USE YOUR CPF?

lawyer Matheus Puppe explains that the collection of personal data such as CPF is permitted as long as it follows the principles established in the LGPD, such as the purpose, adequacy, necessity, transparency, security and prevention.

“This means that the pharmacy, when collecting customer information, must observe the legal basis applied [be it consent or legitimate interest] and strictly follow the purpose informed to the customer”, says the professional, partner of the TMT, Privacy & Data Protection area at Maneira Advogados.

“However, the collection of this data cannot be a condition for the sale of products, unless there is a legal justification for this, such as, for example, the issuance of an Invoice”, he adds.

In other words: the customer must be clearly informed about the reason for collecting their personal data, for example, for the purposes of loyalty programs or to offer discounts — which is permitted.

Opt-out is valid. The commercial establishment cannot force anyone to inform their CPF.

“It is expected that the establishment of the inspection procedure and the development of guidance measures will contribute to improving the protection of personal data in the pharmaceutical sector” adds Antonielle Freitas, data protection specialist at Viseu Advogados.

WHY DO YOU WANT TO KNOW OUR CPF?

The CPF is the starting point that leads into the gigantic universe of data. It is linked to a series of other personal information: full name, address, email, telephone number. Everyone goes hand in hand.

When we think about purchasing a product in a store, providing the CPF can be advantageous for discounts, promotions and participation in points programs. But on the other hand, the company is able to feed its own database, storing the entire history of our purchases — time, day, month, year, products purchased, with what frequency.

Then, everything is crossed with personal data that can easily identify us. Everything stays there, saved in the company's system.

In addition, 90% of the almost 5,000 services made available by the Federal Government are digital, and a large part is accessed from the number CPF, like:

• Salary bonus request
• Consultation and request for amounts receivable for money forgotten in a financial institution
• Consultation on Income Tax refund
• Digital Work Card.

Hence the importance of data protection and correct information about why this request is made and where it will be used.

*With information from Bruna Souza Cruz, from Tilt, and Felipe Mendes, in collaboration with Tilt.

https://www.uol.com.br/tilt/noticias/redacao/2023/05/22/anpd-fecha-o-cerco-e-farmacias-terao-que-explicar-uso-de-dados-de-clientes.htm