Brazil is ignoring the debate on data sharing for advertising

A few months before Covid arrived in Brazil, Nubank sent thousands of letters to potential customers. The challenger bank targeted consumers registered with the Boa Vista SCPC credit bureau. It did so through a “data clean room,” a data-sharing environment where brands can aggregate customer data by target profile without actually accessing the information individually or compromising privacy. 

Such a strategy has not only allowed data brokerage companies to continue operating after the emergence of privacy regulations in Brazil and abroad — years ago, they were doomed to disappear — but has also placed many other companies with robust databases in the position of ideal partners for advertising campaigns. 

Even companies in the health sector that deal with highly sensitive data, such as the giant pharmacy chain Raia Drogasil and Dasa’s genetic research laboratory Genera, are following the same strategy. All because Brazilian privacy laws allow virtually any kind of information sharing for marketing purposes, and there is not yet a critical mass of consumers to challenge this predatory model in court.

When Nubank’s direct mail was sent out, hundreds of consumers were taken aback and somewhat concerned, wondering how Nubank had gotten a hold of their home address. 

Instituto Sigilo, a nonprofit that has questioned this marketing and data-sharing model, filed a lawsuit against Nubank in 2020, arguing that the neobank violated the principles of the 2014 regulatory framework governing the internet in Brazil by using consumers’ data for purposes other than those authorized by them. 

The country’s data protection law, known by the acronym LGPD, came into effect later, in September 2020.

The case is at a standstill because the São Paulo State Court partially accepted a complaint from the neobank’s lawyers, who claimed that the entity lacked the legitimacy to file the lawsuit because it did not represent consumers directly affected by the campaign.

However, the same decision acknowledged that there were sufficient grounds to proceed with the lawsuit, with the Public Prosecutor’s Office as the primary plaintiff. The agency has not yet decided on the matter. 

When contacted, Nubank said it does not comment on ongoing cases and expresses its opinion in the case record. Before the court, its lawyers argued that Nubank did not directly access consumers’ information and that the marketing campaign in question, direct mailing, was not subject to the new regulations because it was a physical action.

Sensitive data is not what it seems

Consumers generally believe that data such as their address or taxpayer ID is “sensitive” data, but the legal understanding is quite different. 

According to the LGPD, “sensitive personal data” is data concerning racial or ethnic origin,...