The Minas Gerais State Court of Appeals (TJMG) rejected an appeal by a financial institution and upheld the decision that voided a contractual clause regarding the sharing of personal data with affiliated companies, subsidiaries, parent companies, or bank partners. The ruling concluded that the clause, included in an adhesion contract without free, informed, and explicit consent, is abusive and violates LGPD (Brazil's General Data Protection Law). The voided clause read:
20.6) I AUTHORIZE the CREDITOR to share my personal data with other related companies, such as affiliates, parent companies, subsidiaries, or service-providing partners in technology, rewards programs, for the purposes of anti-money laundering, profile analysis, credit operation processing, offering more beneficial financial products, financial education, and products and services that may be of my interest.
The court emphasized that the relationship between consumers and financial institutions requires transparency and respect for informational self-determination, making specific and properly highlighted consent essential for the processing and sharing of data. The court stressed that a contractual provision for sharing data for commercial and marketing purposes, without adequately informing the customer or offering an opt-out alternative, violates the constitutional principle of privacy and the standards established in the Consumer Protection Code.
In addition to not providing the contracting party with an alternative to enter into the contract without data sharing, the challenged clause exceeded the legally authorized scenarios, such as compliance with regulatory obligations to Brazil's Central Bank, also including purely commercial purposes. The decision emphasized that the mere formality of a generic authorization in a contract does not fulfill the requirement for free and unequivocal consent demanded by the LGPD.
This post was summarized from the original court decision using AI, with human review.
TJMG/AC No. 5002255-79.2024.8.13.0707