Recently, the Brazilian National Data Protection Authority (“ANPD” or “Brazilian DPA”) applied preemptive measures and initiated an administrative sanctioning process against the company RaiaDrogasil. The ANPD also applied preemptive measures against Febrafar, a Brazilian association of pharmacies.
The scope analyzed included the collection and processing of personal data by the pharmaceutical company, including sensitive data, and the offering of loyalty programs to data subjects, such as the one managed by Febrafar and accessed by affiliated pharmacies. In this regard, the ANPD found that there were non-compliances with the LGPD in the processing carried out, requiring corrective measures.
The preventive measures applied by the Brazilian DPA against RaiaDrogasil included: (i) providing an alternative authentication mechanism to biometrics; (ii) providing a channel for data subjects to obtain information on data storage duration; (iii) submitting several requested documents to the ANPD; and (iv) presenting information to the ANPD regarding the processing of sensitive data, sharing with third parties, and targeted advertising.
Regarding Febrafar, the Brazilian DPA imposed the adoption of a compliance plan, requiring Febrafar to reassess the use of consent in data processing, update information on privacy and the exercise of data subjects’ rights on its website, and ensure the same for its affiliates.
Our team is at your disposal for further clarifications, as well as to provide assistance with the procedures for fulfilling LGPD and/or ANPD regulatory obligations.
Gustavo Flausino Coelho – gustavo@ Fernando Naegele – fernando@