The Governor of the State of São Paulo, João Agripino da Costa Doria Junior – better known as João Doria – sanctioned State Bill # 1212/2019 on December 1, 2020. The bill was authored by State Deputy Alex de Madureira as he is known, since his name is Alexander Muniz de Oliveira, being born in Piracicaba, SP, and affiliated with the Social Democratic Party (PSD).
This law comes into force on December 20, 2020, the date of its publication in the Official Gazette of the State of São Paulo. Thus, from now on, pharmacies and drugstores are prohibited from requiring a CPF from their customers if the requirement is for any discount offered by the store. Currently, this is a fairly common practice. This prohibition obtains throughout the State of São Paulo, including all its municipalities.
By the way, pharmacies and drugstores will have to display notices that are clearly legible with the message:
"REQUIRING A CPF FOR PURCHASE IS FORBIDDEN IF IT IS A CONDITION FOR CERTAIN PROMOTIONS."
It is important to note that the punishment for non-compliance needs to be established for any rule to be enforced. In this case, the penalty will be a fine equivalent to 200 São Paulo State Tax Units (UFESPs – equivalent to R$ 27.61), doubling in cases of recurrence. The penalty certainly seems modest, but enforcement will still depend on monitoring.
In December 2018, Drogaria Araújo, in Belo Horizonte, was fined at R$ 7,930,801.72 for conditioning discounts on the provision of the CPF at the time of purchase, without giving adequate information on registering this data. According to the Attorney General in Minas Gerais State, there was an investigation, and the company refused to alter its conduct. The main legal argument was that it violated the Consumer Protection Code since personal and consumer data registration must be communicated in writing to the consumer, even when they have not solicited it.
On the other hand, the issue calls attention to the validity of asking customers for their CPF, especially as the General Data Protection Law (LGPD) comes into effect. This law currently requires that, for collection and storage to be carried out, the practice falls into one of the legal bases with the concept of processing personal information.
As pharmacies and drugstores, in general, do not require the consent of the consumer – the holder of their own personal information – the foundation will possibly be determined by the legitimate interest of the controller, that is, the pharmacy or drugstore. Still, it must respect both the following conditions:
- support and promotion of the controller's activities; and
- protection, in relation to the subject, of the regular exercise of their rights or provision of services that benefit them, respecting their legitimate expectations and fundamental rights and freedoms, under the terms of this Law.
If the above provision of services is granting a discount, it would be wise for pharmacies and drugstores to review the legal basis for this. The National Data Protection Agency (ANPD) may consider it inappropriate and fine the companies for improper data processing of consumer personal information, especially given that fines levied under the LGPD can be much higher than that of the state law of São Paulo.
Another foundation for a legal basis to enable the collection and storage of personal data could be protecting the health of the data subject. This concerns not only the collection of their CPF but also a copy of the medical prescription. However, new discussions may arise, especially if the collection is for promotional or commercial purposes to sell prescription data to pharmaceutical audit companies or even third parties. This purpose is incompatible with the protection of the data subject's health. While there is no ANPD regulation in this area, the lines will undoubtedly be gray, and there will be legal uncertainty where the consent of the data subject has not been given.
In any case, if pharmacies and drugstores located in the State of São Paulo wish to continue demanding a CPF from consumers, they should have excellent legal advice, or they must rethink this practice.
