In a number of recent incidents, Serasa Experian (a company providing information and data services) has been challenged in Brazil for its alleged commercialization of personal data. In the first of these incidents, a Brazilian Federal District Court in Brasilia ordered the company to stop selling personal data of consumers, under penalty of a daily fine. The case involved a civil action taken by the Public Prosecutors Office, alleging that the company’s activities violate the LGPD (Brazil’s Data Protection Law). The case alleges that the company sells personal profile information (including in packages starting at a cost of R$1 per registered person) to companies looking to attract new customers, and that it is involved in the trade of the personal data of more than 150 million Brazilians, including names, personal ID numbers (CPF), telephone numbers, location, financial profile, purchasing power, and social class.
The public prosecutor that brought the action argued that the practices also violate other laws, such as the Brazilian Civil Code, the Consumer Protection Law, and the Brazilian Civil Rights Framework for the Internet.
In a more recent development, the Brazilian National Consumer Secretariat (Senacon) asked Seresa Experian to provide clarifications over its possible involvement a data leak of information concerning more than 223 million Brazilians, which occurred in August 2019. During this process, it was pointed out that Senecon operates independently of the powers given to the National Data Protection Agency (ANPD).
