Personal Data in Loyalty Programs

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Loyalty programs accumulate far more than points: they collect spending habits, preferences, and sensitive data that require strict protection under the LGPD.

How Loyalty Programs Collect and Use Personal Data

When you join a loyalty program, you provide information that goes well beyond your name and CPF (Brazil’s individual taxpayer registry number). Programs run by airlines, pharmacy chains, supermarkets, and credit card issuers record every transaction you make, building a detailed profile of your consumer behavior. This profile typically includes how often you shop, your average spending, your preferred product categories, your usual shopping times, and even your movements when the program is linked to a mobile app.

Brazil’s General Data Protection Law (Law 13.709/2018), known as the LGPD (Lei Geral de Proteção de Dados), classifies this information as personal data and, in some cases, as sensitive personal data. Health data collected by pharmacy programs (such as a history of the medications you have purchased) receives even stricter protection and requires the data subject’s specific and prominent consent. Many loyalty programs do not draw this distinction when they ask consumers to join. Instead, they present generic terms that fail to meet the law’s requirements of transparency and purpose.

The business model behind these programs often depends on monetizing the data they collect. The information is used for targeted advertising and shared with commercial partners. In more troubling cases, it is sold to third parties without the data subject clearly knowing about it. In this context, a data due diligence review becomes an essential tool, both for companies assessing whether their operations comply with the law and for consumers who want to understand how far the processing of their information extends.

Applicable Legal Bases and Company Obligations

To process personal data in loyalty programs, companies must ground their operations in one of the legal bases set out in the LGPD. Consent (Article 7, item I) is the most commonly used basis, but it must be freely given, informed, and unambiguous, and it must be granted for specific purposes. A common practice is to make program benefits conditional on accepting long, generic terms in their entirety. That practice can amount to defective consent and make the processing unlawful.

Performance of a contract (Article 7, item V) can also support part of the processing, especially managing accumulated points, recording transactions, and communicating about the program. However, this legal basis does not authorize sharing data with third parties for advertising purposes, or building behavioral profiles that go beyond what the program needs to operate. Many companies use this basis far too broadly, processing data for purposes that have no direct connection to the service the consumer actually contracted.

Legitimate interest (Article 7, item IX) requires a data protection impact assessment report on personal data protection, documenting the balance between the company’s interests and the data subject’s rights. The ANPD (Brazil’s National Data Protection Authority) has been paying increasing attention to processing based on this ground, especially when it involves profiling consumers. Companies that run loyalty programs must keep this documentation current and available for inspection.

A data due diligence review of loyalty programs shows that consumers often hand over valuable information about their habits without receiving a proportionate level of transparency about how that data will actually be used.

As for specific obligations, companies must ensure the following: they must appoint a data protection officer (DPO); implement technical security measures that fit the volume and sensitivity of the data processed; respond promptly to data subjects’ rights requests (access, correction, deletion, portability); and notify the ANPD of any security incident that may cause significant risk or harm to data subjects.

Data Due Diligence: Assessing Risk and Compliance

Data due diligence for a loyalty program is a systematic review of how the program collects, stores, shares, and deletes personal data. This process is essential for companies that want to operate in compliance with the LGPD. It is equally important for investors and business partners who need to assess risk before associating themselves with a particular program.

On the corporate side, due diligence should examine the program’s privacy policy and check whether it meets the clarity and completeness requirements of Article 9 of the LGPD. The critical points include: precisely identifying the purposes of processing, naming the third parties with whom data is shared, stating the retention period, describing the mechanisms available for exercising data subject rights, and disclosing whether data is transferred internationally.

The technical security assessment is another essential pillar. Loyalty programs with millions of participants are attractive targets for cyberattacks, given the volume and richness of the information they store. Due diligence should examine the encryption measures in place, the access controls on databases, whether incident response plans exist, and whether vulnerability testing is performed regularly.

For consumers, personal due diligence means reading the enrollment terms carefully, checking the privacy settings available in the program’s app or portal, and monitoring the communications you receive. You should periodically exercise your right of access (Article 18, item II, of the LGPD) to confirm which data is actually being processed and whether it matches what you were told when you enrolled.

Consumer Rights and Protection Mechanisms

A loyalty program participant holds all the rights set out in Article 18 of the LGPD, and may exercise them at any time by submitting a request to the controller. The right of access lets you obtain a complete copy of the personal data being processed, including derived information (such as behavior scores and profile classifications). Many companies still give incomplete answers to these requests and omit inferred data, which the law protects just the same.

The right to deletion deserves special attention in the context of loyalty programs. When you cancel your participation, you are entitled to have your personal data deleted, subject to the retention exceptions in Article 16 of the LGPD (compliance with a legal obligation, study by a research body, transfer to a third party with a legal basis, and exclusive use by the controller with anonymization). Some companies keep former participants’ data for unjustifiably long periods, citing vague needs such as “auditing” or “fraud prevention” without showing that the retention is proportionate.

The right to portability (Article 18, item V) allows you to request that your data be transferred to another program or provider, in accordance with ANPD regulations. Although the specific regulations are still being developed, the right can already be exercised, and it is an important tool for promoting competition in the sector. The right to revoke consent (Article 8, paragraph 5) allows you to withdraw your authorization at any time through an express statement, using a free and simple procedure.

If a company violates the LGPD, you can file a complaint directly with the ANPD, which has the authority to impose administrative sanctions, including a warning, a fine of up to 2% of revenue (capped at R$ 50 million per violation), public disclosure of the violation, and blocking and deletion of the data. You can also go to court to seek compensation for material and moral damages caused by the unlawful processing of your personal data, on the basis of both the LGPD and the Consumer Protection Code (Código de Defesa do Consumidor).

Best Practices and Recommendations for Companies and Consumers

Companies that run loyalty programs should adopt the principle of privacy by design, building data protection into the program from the start. This means collecting only the data strictly necessary for the stated purposes (minimization), using anonymization and pseudonymization whenever possible, and adopting default settings that favor user privacy (privacy by default). Conducting data protection impact assessments periodically and reviewing the terms of use on an ongoing basis show a commitment to compliance and significantly reduce exposure to regulatory risk.

Transparency should be treated as a core value of the operation. Terms of use written in accessible language, with a clear and specific description of the purposes of processing and the third parties involved, not only satisfy the legal requirement but also strengthen the relationship of trust with consumers. Programs that adopt transparent practices tend to see greater engagement and fewer cancellations.

For consumers, we suggest caution when joining loyalty programs. Consider whether the benefits offered are proportionate to the amount of data requested. Limit the permissions you grant to apps (especially access to your location, contacts, and camera), use the most restrictive privacy settings available, and periodically exercise your right of access to monitor how your data is being handled. If you spot irregularities, file a formal complaint with the controller. If the violation continues, report it to the ANPD or seek specialized legal advice to evaluate the measures available to you.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.