A few days before Black Friday, Burger King opted for a different strategy to promote one of its promotions aimed at the most anticipated date on the consumer calendar. Known for producing guerrilla and more disruptive marketing actions, the brand used PIX as a promotional strategy this Monday (25), transferring R$ 0.01 to BK Club customers. The messages highlight that, with just a few cents more, it is already possible to take advantage of the special offers.
But, ultimately, could the campaign by the fast-food restaurant chain violate the General Data Protection Law (LGPD)? According to Alexander Coelho, partner at Godke Advogados and specialist in Digital Law and Data Protection , there are indications that the campaign may indeed violate the LGPD, depending on how the data was handled and the absence (or not) of specific consent.
“The most critical points are the issue of purpose, since consumers provided their PIX keys for financial transactions, not for marketing. Using them for another purpose could constitute misuse. Secondly, explicit consent for such use would be a more secure legal basis. Otherwise, the use of legitimate interest would need to be very well-founded in a data protection impact assessment (DPIA), which does not always happen in practice. The third point is transparency: were consumers aware and did they agree that their data would be used for this campaign?” the lawyer asks.
Coelho explains that PIX, as a payment method, was not designed for commercial communications or marketing. "However, if the data used comes from a legitimate prior relationship, such as a loyalty program or purchase history, and respects the legal basis of legitimate interest, the company can argue that it is protected," he considered.
However, this practice is not without risks. Using data for purposes other than those previously informed to the data subject may be considered a misuse of data (Article 6, I of the LGPD). The expert also points out that the use of PIX as a means of communication is new territory and lacks specific regulation.
“Although creative, this Burger King campaign falls into a gray area under the LGPD (Brazilian General Data Protection Law). To avoid problems, companies should align their marketing strategies with good data protection practices, ensuring that their campaigns are not only innovative but also respect the privacy of their customers. After all, the line between creative engagement and data abuse is thin, and as they say, 'to err is human, but to err with PIX (Brazil's instant payment system) can go viral',” he concludes.
How to protect yourself?
According to lawyer Alexander Coelho, consumers can take the following measures in response to campaigns with the strategy presented by the network:
- Consult the loyalty program: Check the program's terms and conditions to understand how your data may be used.
- Demand clarification: Request from the company, based on the right to information under the LGPD (Brazilian General Data Protection Law), how the data was obtained and what the legal bases were for its processing.
- File a complaint with the ANPD: If you identify that your rights have been violated, you can file a formal complaint with the National Data Protection Authority (ANPD).
- Pay attention to consent: Always review the permissions granted when joining loyalty programs or promotions.
- Be careful with PIX keys: Use a less sensitive key (such as email or phone number), especially in situations involving registration on commercial platforms.
