Nubank survey that pays up to R$450 will do what with your data?

News was recently published that the Nubank will pay its selected clients BRL 450.00 if they answer a previous questionnaire on income tax and on investments, and if they are chosen to participate in a second stage of this research, that is, not just answer the questionnaire and that’s it! Has won. Nubank has to choose you, and who knows what the criteria for that choice are.

Many people loved the “promotion”, after all, it is “just” to answer a survey and pocket the money. Only BRL 450.00 for your most precious data, which is your income tax data, which no one has access to unless with a court order or if you provide it.

It turns out that practically no one is concerned about what will be done with their data, since Nubank has not even clarified the purpose of this “research” and what will be done with the data collected, contrary to item I of article 6 of the LGPD¹, which determines that it is explained for what purpose these data will be processed.

Fonte: Shutterstock

According to the Brazilian LGPD – General Data Protection Law, it is mandatory for all companies to inform why our data is collected and what is done with them, and the treatment can only be carried out in accordance with the authorization given by us. , but this authorization can only be given if we know beforehand what will be done.

The R$ 450.00 advertised is actually a gimmick for the most unsuspecting, but as you read this article, you won’t just fall for it. If you agree to give your data, it will be done consciously.

It is not because the bank customer accepted to participate and gave Ok, that Nubank can merely collect this information and use it as it wishes. He, like any other company, is obliged to disclose in advance for what specific purpose the data will be used.

Imagine a hypothetical situation where Nubank uses this information to know who is considered a good or bad customer, based only on the information provided by the participants, and uses this information to charge higher or lower fees, based on each one’s income and assets.

If you had known this in advance, would you have participated? If yes, fine. There’s nothing wrong. The question is who would not have participated if they had known.

Still, it may be that Nubank is infringing item IV of article 4, item III of article 8, article 43, of the Consumer Protection Code, since all bank customers are considered consumers, so they are entitled to information.

But even if Nubank says that this data will be used for an investment research, don’t you think that “this information does not inform anything”? Isn’t it very generic? Investment research for what purpose? How long will the data be stored? And the data of those who are not selected, will they be deleted or will they be stored? So, we can say that everything is in disagreement with article 9 of the LGPD².

And of course Nubank will not choose all its customers to participate in the second phase, so that means that all the other participants provided their data for free to Nubank and did not receive anything for it, and they do not even know what will be done with this data. .

Big deal for Nubank, it could be a loss for customers

Loss because the customer is selling his most valuable data for a measly R$ 450.00! That’s right! Measly BRL 450.00! It is obvious that the income tax data is worth much more, since the client will practically open the entire financial and patrimonial life, and this, in my opinion, is worth much more than this amount.

So, the advice is: before providing your data, ask what the purpose is. Forget the R$ 450.00 and focus on what can be done with all this data that you are going to share, and remember that even if the LGPD forces Nubank, or any other company to erase this data, it is impossible to be sure. that this will be done.

But if you agree to provide this data, do so consciously and knowing the risks you may run.


  • ¹Art. 6th The personal data processing activities must observe good faith and the following principles: I – purpose: carrying out the treatment for legitimate, specific, explicit and informed purposes to the holder, without the possibility of further processing in a way incompatible with these purposes;
  • ²Art. 9 The data subject has the right to facilitated access to information on the processing of their data, which must be made available in a clear, adequate and ostensible way about, among other characteristics provided for in regulations to comply with the principle of free access: I – specific purpose of treatment; II – form and duration of treatment, subject to commercial and industrial secrecy; III – identification of the controller; IV – controller contact information; V information about the shared use of data by the controller and the purpose; VI – responsibilities of the agents who will carry out the treatment; and VII – rights of the holder, with explicit mention of the rights contained in art. 18 of this Law.

Rofis Elias Filhocolumnist for TecMundo, is a geek and lawyer, passionate about technology since he was little. He was the first on the street to have internet at home, in 1994, and specialized in Computer Law in Brazil and Portugal. Today, he is a professor of the same subject at several institutions, having been the executive coordinator of the postgraduate course at ESA / SP. He is a partner at Elias Filho Advogados, which works for several technology companies in Brazil and abroad. Follow on social media for more tips: @eliasfilhoadv.

Leave a Comment