Risk and Personal Information: the Finality Principle and Data Protection in the Brazilian Legal System

Abstract

The use of personal data has become a fundamental tool for the development of various activities both in public and private domains. In industries that work with the risk as a key factor, such as insurance and financial ones, the analysis of such risk is made possible precisely through the data collected about potential customers. Based on this analysis, insurance companies and financial institutions classify their potential customers into predetermined categories, setting premiums and interest rates according to each situation or, when it is the case, rejecting the risk. However, the collection of personal data cannot be indiscriminate, some parameters must be observed, being the main important the finality principle. This article seeks to define the scope of the “principle of finality” for risk analysis, either the risk related to the possibility of occurrence of a loss in the case of the insurance activity, or concerning the possibility of default over contractual obligations, in the case of financial activity, based not only on national standards that deal with data protection and privacy, but also on the interpretation given by the Brazilian Supreme Court (Supremo Tribunal Federal) and by the Superior Court of Justice (Superior Tribunal de Justiça) on this subject.