In recent years, the practice of asking restaurants for customers’ CPF at the end of a purchase has become common. This is done to promote discounts and exclusive benefits in return. Commercial establishments attract consumers looking for savings, but this strategy can raise concerns about privacy and legal compliance.
With the implementation of the General Data Protection Regulation (LGPD) in September 2020, CPF considers personal data sensitive, requiring prior, clear and specific consent for its collection and use. Failure to comply with the legal guidelines can result in serious penalties for organizations.
Privacy and Legality
Issues such as privacy arise primarily due to the potential for misuse or leakage of this sensitive information. Although the LGPD provides exceptions for the use of data without explicit consent in certain legal circumstances, such as regulatory obligations, these exceptions do not apply to commercial purposes without the direct permission of the data subject.
Therefore, restaurants must not only obtain proper consent from customers, but also implement strong data security measures such as encryption and employee training in order to protect the information collected.
The National Data Protection Authority (ANPD) has announced increased control over the excessive collection of personal information. In São Paulo, for example, Law 17,301/2020 already explicitly prohibits requiring customers’ CPF numbers without clearly indicating the purpose of opening the registration to grant benefits.
Understand your rights
It is very important for consumers to know their rights and know how to exercise them. Each restaurant has a specific process for deleting personal data, which is available on their privacy portals.
Therefore, consumers have the right to request the deletion or correction of their data if they feel it has been used inappropriately.
Finally, given the high fines imposed by the LGPD, which can reach R$50 million, protecting your personal information becomes not only a legal issue, but also a commercial and ethical responsibility.
