The present study assesses the way credit bureaus (‘CB’) make use of personal data – through collection, process and access –, thereby focusing on the possible impacts that such use exerts on vulnerable groups, aiming to identify the best practices that can render more transparent and informed the relationship between CB and personal data subjects.

The study has three parts. In the first section, we discuss how CB handle concepts such as risk assessment and how the use of personal data may lead to discriminatory conducts in credit granting. Secondly, we display the Brazilian legislative panorama regarding the protection of personal data. In the last part, we finally draw our conclusions on the data access mechanisms that CB provide, based on the analysis of the terms of use of the services that Serasa-Experian (in relation to the Mosaic service) and Boa Vista offer. Moreover, we make considerations about the best practices that CB shall adopt for services relative to the collection, process and access of third-party data.

The methodology of this work consisted of a legal analysis of the service contracts of these CB available both on their own websites and on the pages of public entities with which the CB have contract. It equally included an assessment of the products and the information that these CB make available on their websites.

Access: complete version in Portuguese.

Access: short version in Portuguese.

Access: version in English.