Dados pessoais sensíveis de saúde e farmácias: desvio de finalidade e os limites da tutela penal

The processing of personal data must comply with the purpose limitation principle, precluding its generic collection or use incompatible with the purpose disclosed to the data subject. Brazilian pharmacies routinely collect consumers national taxpayer ID (CPF) under vague justifications, data which, when linked to medication purchases, proves sensitive by indicating the data subject's health status. This study examines the risks of this practice and the insufficiency of Brazilian criminal law protection in the face of purpose deviation, underscoring the pressing need for debate on the specific criminalization of conduct that violates the LGPD.