The National Data Protection Authority (ANPD) has notified the Raiadrogasil pharmacies network, the STIX loyalty program and the Brazilian Federation of Associative and Independent Pharmacies (Febrafar) on the process of enforcement of consumer -sensitive personal data. The three institutions have been investigated since May 2023.
EP has decided to establish a sanctioning administrative proceeding against Raiadrogasil to investigate possible violations of the General Data Protection Law (LGPD). The company is suspected of forming behavioral profiles from consumer -sensitive personal data to offer targeted advertising and obtain economic advantage.
ANPD has also applied a preventive measure against the company, which will be required to offer universes to clients with an alternative identity verification to biometrics. The company will also have to facilitate customers’ access to information about the storage time of their personal data. In addition, you should present to the authority a series of information and documents on how personal data is used to create profiles and data sharing with RD ADS company from the Raiadrogasil Group.
Regarding febrafar, the preventive measure determines the reassessment of the legal hypothesis for data processing and the adequacy of information regarding privacy and data protection. It also determines the exercise of rights of the holder on his site. Febrafar should act to ensure that its associates also promote the facilitated access of the holder to a channel to exercise their rights.
Regarding STIX, the decision was to file the case, without prejudice to further investigation, if new facts arise.
“Preventive measures applied are not sanctions but an express determination of ANPD’s inspection, indicating the actions that the supervised companies must adopt to correct the identified problems. Failure to comply with these measures, however, may result in the opening of a sanctioning process and the worsening of the sanctions eventually applied, ”explained the general coordinator of the ANPD, Fabrício Lopes.
In a statement, Raiadrogasil’s press office said the company’s practices comply with the General Data Protection Law. “All information is protected by a safe system and personal identification is a customer option. The company remains at the disposal of ANPD for the clarifications that the agency considers necessary, “says the note.
THE Brazil agency He contacted Febrafar, and is open to his demonstrations.
