Brazilian bank ordered to pay damages for exposing client data during debt collection

A court in Penha, Santa Catarina, has ordered a financial institution to pay R$ 8,000 in moral damages to a client after the bank repeatedly exposed personal data to a third party during debt collection attempts.

Although the debt itself was legitimate, the bank sent messages, negotiation proposals, and a bank slip containing the debtor's name, CPF, residential address, and debt details to a phone number not listed in the original contract. Despite the client contacting the bank to report the error and requesting that contact information be restricted to the authorized number, the bank continued to send the sensitive information to the wrong recipient.

The judge ruled that while creditors have the right to collect debts, they must do so in a direct, confidential, and respectful manner. The decision emphasized that revealing restricted contract information to unauthorized individuals constitutes a violation of privacy.