The ANPD notified Claro and Serasa following an investigation into a partnership between the two companies under which Claro would provide customer personal data to Serasa for the development of credit analysis methodologies and market condition assessments. Claro will face a sanctioning administrative proceeding, while Serasa will be subject to a supervisory investigation.<\/p>\n\n\n\n
The sanctioning proceeding stems from the findings of an earlier supervisory action opened against Claro on suspicion of non-compliance with the LGPD in connection with its partnership with Serasa. According to the ANPD’s Superintendent of Supervision, Fabr\u00edcio Guimar\u00e3es, Claro shared over one hundred data points per customer, a volume considered excessive and incompatible with the necessity principle. The investigation also identified a lack of transparency toward data subjects and difficulty in accessing the company’s data protection officer.<\/p>\n\n\n\n
If the irregularities are confirmed, Claro may be subject to the sanctions set forth in Article 52 of the LGPD, which include, among other measures, a fine of up to 2% of the company’s revenue, capped at BRL 50 million, per violation. Claro also received a formal notice setting out requirements to be observed in its data sharing agreements.<\/p>\n\n\n\n
In Serasa’s case, the ANPD will assess the transparency provided to data subjects and the mechanisms available for the exercise of their rights. The investigation will examine whether the company’s privacy policy adequately discloses who shares data with Serasa and to whom it further transfers that data. If irregularities are identified, the matter may advance to the sanctioning phase.<\/p>\n\n\n\n
Both companies have ten business days from receipt of the notification to submit their defense. Failure to respond within that period may constitute obstruction of the supervisory process and result in an additional sanction.<\/p>\n\n\n\n