Court voids generic personal data sharing clause in loan contract

The Minas Gerais State Court of Appeals denied the appeal filed by Banco Pan S.A. and upheld the ruling that declared null a contractual clause allowing the compulsory sharing of personal data with third parties. The decision was issued by the 13th Civil Chamber in a contract review action brought by a client who challenged the validity of clause 20.6 of her personal loan agreement.

The challenged clause authorized the bank to share the client's personal data with other related companies, including affiliates, parent companies, subsidiaries, and service partner companies, for purposes such as anti-money laundering compliance, profile analysis, credit transaction processing, and financial product offerings. The bank argued in its defense that the clause was intended to protect the consumer and that it operated in compliance with LGPD (Brazil's General Data Protection Law) requirements.

The reporting judge grounded the decision in the LGPD (Law No. 13,709/2018), specifically Articles 7, item I, and 8, paragraph 4, which establish that the processing of personal data must be carried out with the data subject's consent and that generic authorizations for personal data processing are null and void. The court found that the clause was generic and violated the provisions of the LGPD, and that it had been inserted in a standard-form contract without giving the consumer any opportunity to object to the data sharing.

The ruling followed precedents from the Superior Court of Justice (STJ) that have already recognized the abusive nature of data sharing clauses in standard-form contracts with financial institutions. The court also highlighted that the LGPD establishes that consent may be revoked at any time through a free and straightforward procedure — a right that the bank had failed to adequately ensure. The financial institution was ordered to pay court costs and attorney's fees increased to 15% of the value of the claim.

This post was summarized from the original ruling using AI, with human review.

TJMG/AC n. 5000078-94.2024.8.13.0335