Data leak investigation motivated by Brazilian Report story gains scale

On Monday, the Federal Prosecution Office requested an investigation into the data systems of Caixa, a state-owned bank, and DataPrev, the public company that manages the database of all pensioners and beneficiaries of welfare programs. 

The goal is to find out where and how the personal data of millions of Brazilians is leaking from government agencies, and was motivated by an exclusive story published by The Brazilian Report on October 22, 2022.

Documents obtained by The Brazilian Report showed that bank representatives had access to the private data of millions of low-income voters and offered them payroll deduction loans. 

These loans were part of Jair Bolsonaro’s re-election strategy. As the former president tried to create a feel-good factor around the economy, he allowed welfare beneficiaries access to credit — but many economists warned at the time that these loans could easily become debt traps for the targeted population strata — as recipients could commit up to 40 percent of their monthly income to repayments.

We exposed the leak of private information belonging to at least 3.7 million beneficiaries of the Auxílio Brasil cash transfer program to bank representatives selling the loans. 

Prosecutors are now asking for a cross-check examination of data between the list obtained by The Brazilian Report and the people who received payroll deduction loans during the presidential runoff campaign.

The case is part of what legal experts consider the most serious legal battle Mr. Bolsonaro will face in the electoral courts: the alleged use of social programs for his political benefit. He has already been declared ineligible for office for spreading misinformation about the electoral system.

The Federal Prosecution Office has asked to be a co-plaintiff in a civil lawsuit filed by the Sigilo Institute, a data privacy organization, requesting the payment of damages to those whose information was exposed. It also seeks the payment of compensation to a civil rights fund.

The claim will be analyzed by a federal court in São Paulo.

Following the report, Brazil’s National Data Protection Authority also launched an internal process to investigate possible data privacy violations by the Brazilian government.

The list of information held by the banks included people’s full address, mobile and home numbers, date of birth, the amount of benefits they receive each month, their registration number in the government’s NIS social security database, and their public health ID numbers.

• #justice