Brazil’s government convicted for data leak exposed by The Brazilian Report

Federal government agencies were convicted for leaking data of beneficiaries of Auxílio Brasil, a flagship federal aid program now renamed Bolsa Família, to financial agencies offering payroll deduction loans to low-income Brazilians. 

Prior to elections last year, the administration of former President Jair Bolsonaro launched a program allowing people enrolled in aid programs to sign up for payroll deduction loans — a government push to create feel-good factors around the economy. 

On October 22, 2022, The Brazilian Report exposed the leak of private information relating to at least 3.7 million beneficiaries of the Auxílio Brasil benefit scheme. Bank representatives used this data to propose payroll deduction loans to these people during the presidential runoff campaign.

Based on our story (and following a complaint by the Sigilo Institute, a data protection watchdog), Federal Judge Marco Aurélio de Mello Castrianni ordered the Citizenship Ministry, state-owned bank Caixa, the Brazilian Data Protection Authority (ANPD), and Dataprev, the public firm in charge of the monthly payroll of all pensioners and beneficiaries of welfare programs, to find and control the leak, and to enhance their data protection mechanisms.

The public entities also must pay BRL 15,000 (USD 3,000) in compensation to each person whose data was leaked, and lodge BRL 40 million into a public fund that aims to repair damages related to consumers, goods, and rights. Caixa must report the situation to each of its beneficiaries, and ANPD is required to start its own audit of the issue.

The Auxílio Brasil cash-transfer scheme targeted Brazil’s poorest, and recipients were invited to commit up to 40 percent of their monthly revenue to loans. 

The payroll loan program was discontinued in January 2023, after several criticisms by experts who said it artificially inflated the income of a large portion of the electorate. The Federal Prosecution Office said the loans were illegal and led socially vulnerable people into debt traps. 

In his decision, Judge Castrianni wrote: “Journalistic reports delved deeper into the topic and narrated that the beneficiaries of the Auxílio Brasil Program had been blackmailed in the sense that if Luís Inácio Lula da Silva won the election, they would lose the benefit.”

“It is known that whether the leak had an electoral nature or not, or any other goal, it constitutes a serious fact, and its extent must be investigated, its dissemination stopped and those involved held accountable.”

The federal judge stated that the victims trusted the federal bodies and that the misuse of their personal data for fraudulent purposes “may also cause further harm to them.”None of the entities convicted offered a comment when contacted by The Brazilian Report. They can still appeal the decision to higher courts.

---

Update: Caixa tells The Brazilian Report it has not yet been informed of the decision, and stressed that it didn’t identify any leak of information held by the bank. “Caixa periodically conducts security assessments of [aid programs’ registry systems], aiming at identifying possible vulnerabilities that could generate improper access to data, promoting constant improvements in controls.”

• #dataProtection