Urgent Warning for Those Who Provide Their CPF When Purchasing at Pharmacies in May

Recently, it has become common practice in many Brazilian pharmacies to request customers’ CPF during the purchasing process. This practice is adopted by large chains, including Drogasil, Droga Raia and Onofre, with the aim of offering discounts and participation in loyalty programs. However, this practice raises significant concerns related to personal data privacy and legal compliance.

What does the General Data Protection Law say about the CPF?

The General Data Protection Law (LGPD), which came into force in September 2020, marks a significant advance in the protection of personal data in Brazil. According to the LGPD, the CPF is considered sensitive personal data and its use requires prior, explicit and informed consent from the data subject. This requirement calls into question the legality of CPF collection by pharmacies without due process of consent.

Is there an exception for using the CPF without consent?

Although the LGPD establishes strict rules, it also provides for some exceptions where the processing of personal data can occur without prior consent. This includes, for example, compliance with a legal or regulatory obligation. However, using the CPF for commercial purposes without explicit authorization is a practice that can expose pharmacies to legal risks and sanctions.

Security measures and consumer rights

To comply with the LGPD, pharmacies must adopt robust data security measures, such as encrypting information and constantly training employees on the importance of data protection. Furthermore, it is essential that consumers are clearly informed about the use of their data, always having the option of not providing their CPF or requesting the subsequent deletion of the collected data.

What should you do if your CPF is misused?

If you suspect that your data is being used inappropriately or without your explicit consent, it is important to take action. First, request the deletion of your data from the pharmacy chain. If this is not respected, you have the right to contact the National Data Protection Authority (ANPD) or consumer protection agencies to assert your rights.

• Raia Drogasil Network: To delete or correct data, visit the company’s privacy portal and fill out the specific form.

• DPSP Group (Drogaria São Paulo and Drogaria Pacheco): information can be corrected or deleted through the group’s official portal.

In conclusion, while providing your CPF may seem like a small detail when purchasing medicines or other products from pharmacies, it is vital to consider the privacy implications and be aware of your rights under data protection law. The penalties for companies for non-compliance with the LGPD are severe, reaching up to R$50 million, which demonstrates the seriousness with which the issue is treated in Brazil.