INFORMATION PROTECTION AND CREDIT RESTRICTIONS: LIMITS TO THE PERPETUATION OF CONSUMER DATA
15 de agosto de 2026TUTELA DA INFORMAÇÃO E RESTRIÇÕES DE CRÉDITO: OS LIMITES À PERPETUAÇÃO DE DADOS DO CONSUMIDOR
Artigo submetido em 14 de agosto de 2026
Artigo aprovado em 14 de agosto de 2026
Artigo publicado em 15 de agosto de 2026
| Scientia et Ratio Volume 6 – Número 10 – 2026 ISSN 2525-8532 |
.
.
ABSTRACT : The expansion of e-commerce and social networks has significantly modified consumer relations, also amplifying the challenges related to the use of personal data and financial information in the credit market. This research analyzes the legal limits of the use and retention of this information, focusing on credit scoring and the internal score of financial institutions. To this end, it examines the protection afforded by the Consumer Protection Code, the Brazilian Civil Rights Framework for the Internet, and the General Data Protection Law, considering the need to guarantee transparency and security in consumer relations carried out in the digital environment. It also analyzes the understanding of the Superior Court of Justice, especially Topic 710 and Summary 550, which recognize the legality of credit scoring and dispense with the prior consent of the consumer, without disregarding the limits related to the use of information. Finally, it addresses the possibility of old data continuing to influence the internal bank score , considering the restrictions established by Article 43 of the Consumer Protection Code and the understanding of the Supreme Federal Court regarding the right to be forgotten. It is concluded that the use of risk assessment tools is legitimate and relevant to the credit market, but it does not authorize the unlimited use of old, incorrect, or inadequate information.
Keywords: Consumer Protection Code; Data Protection; Right to be Forgotten; LGPD (Brazilian General Data Protection Law); Restrictive Registries.
RESUMO: A expansão do comércio eletrônico e das redes sociais modificou significativamente as relações de consumo, ampliando também os desafios relacionados à utilização de dados pessoais e informações financeiras no mercado de crédito. A presente pesquisa analisa os limites jurídicos da utilização e conservação dessas informações, com enfoque no credit scoring e no score interno das instituições financeiras. Para tanto, examina-se a proteção conferida pelo Código de Defesa do Consumidor, pelo Marco Civil da Internet e pela Lei Geral de Proteção de Dados, considerando a necessidade de garantir transparência e segurança nas relações de consumo realizadas no ambiente digital. Analisa-se, ainda, o entendimento do Superior Tribunal de Justiça, especialmente o Tema 710 e a Súmula 550, que reconhecem a licitude do credit scoring e dispensam o consentimento prévio do consumidor, sem afastar os limites relacionados à utilização das informações. Por fim, aborda-se a possibilidade de dados antigos continuarem influenciando o score interno bancário, considerando as restrições estabelecidas pelo art. 43 do Código de Defesa do Consumidor e o entendimento do Supremo Tribunal Federal acerca do direito ao esquecimento. Conclui-se que a utilização de ferramentas de avaliação de risco é legítima e relevante para o mercado de crédito, mas não autoriza o uso ilimitado de informações antigas, incorretas ou inadequadas.
Palavras-chave: Código de Defesa do Consumidor; Proteção de Dados; Direito ao Esquecimento; LGPD; Cadastros Restritivos.
1 INTRODUCTION
The transition to the era of massive data has redefined the dynamics of consumer relations and the flow of information in contemporary society. While the digital ecosystem has increased operational efficiency and facilitated access to credit, it has also exposed individuals to a perpetual informational memory, in which past records can perpetuate stigmas and restrict the exercise of fundamental rights. In this context of intense data circulation and informational asymmetry, the right to be forgotten emerges as an important instrument for protecting personality, imposing limits on the maintenance and processing of personal information that no longer serves the purpose for which it was originally collected.
Although the debate surrounding the right to be forgotten is traditionally linked to criminal law, the right to one’s image, and the de-indexing of content from internet search engines, its application in the context of consumer relations reveals its own unique characteristics and growing relevance. The application of this principle to credit protection databases and registries, such as SPC and Serasa, demonstrates that protecting consumers against the perpetuation of outdated negative records is an essential requirement for their economic reintegration, the preservation of their dignity, and the realization of the principle of objective good faith.
Given this scenario, the present work seeks to answer the following research question: to what extent do the time limitations foreseen in the Consumer Protection Code, especially the maximum period of five years established in article 43, § 1, contribute to preventing the perpetuation of negative information and to protecting the consumer against undue restrictive effects in credit relations? The aim is to understand whether the lapse of the legal period constitutes a mere formal extinction of the record or whether it effectively concretizes the informational self-determination of the data subject and their protection against the perpetuation of outdated information.
The overall objective of this article is to analyze the application of the right to be forgotten within the consumer protection microsystem, examining the intersections between the Consumer Protection Code (CDC) and the General Data Protection Law (LGPD), especially regarding the right to data deletion, the processing of credit history, and the limits on the retention of personal information. Furthermore, it aims to understand the consolidated jurisprudential understanding of the Superior Court of Justice (STJ) and the Supreme Federal Court (STF) concerning the protection of personal data and the limits on maintaining records in databases.
Methodologically, the study adopts the analytical-deductive method, using bibliographic research and document analysis as technical procedures. This work is based on consumer, civil-constitutional, and data protection doctrine, as well as applicable legislation, especially the Consumer Protection Code (CDC) and the General Data Protection Law (LGPD), in addition to the jurisprudence of the superior courts, with the purpose of identifying the legal limits of the retention of information in credit registers and verifying to what extent the right to be forgotten contributes to the effective protection of the consumer in the information society.
2. The Concept and Evolution of the Right to be Forgotten
The understanding of the right to be forgotten in the Brazilian legal system has undergone different doctrinal and jurisprudential constructions over the last few decades.
Initially related to the protection of personality rights against prolonged exposure of past events, the concept has also come to be analyzed from the perspective of the need to reconcile the protection of dignity, privacy, and private life with the freedoms of expression, of the press, and of access to information.
The debate took on new dimensions with the expansion of the internet and the permanence of content in the digital environment, since old information became easily located and disseminated again, regardless of the time elapsed. In this context, it became necessary to establish limits between the protection of collective memory and the safeguarding of the individual against the abusive use of information related to their past.
In order to understand this evolution, this chapter initially addresses the origin and foundations of the right to be forgotten, especially its relationship with personality rights and the principle of human dignity. It then analyzes the change in orientation promoted by the Supreme Federal Court in the judgment of Extraordinary Appeal No. 1,010,606, under Theme 786 of general repercussion.
Finally, the distinction between the non-existence of a general right to be forgotten and the persistence of specific mechanisms for protecting and limiting the use of information provided for in specific legislation, especially in the Consumer Protection Code and the General Data Protection Law, is examined. This difference is relevant for the subsequent analysis of the use of consumer information in the context of credit relations.
2.1 Origin and Foundation of the Institute
Traditionally, the right to be forgotten has been conceived as the possibility of preventing or limiting the repeated disclosure of truthful facts related to an individual’s past when, due to the passage of time, their exposure could cause disproportionate harm to personality rights. The concept has thus become associated with the protection of honor, image, privacy, and private life in the face of the re-exposure of events that no longer present significant public interest.
The contemporary construction of the institute relates to the protection of privacy and personality rights, but it has acquired new dimensions in the context of the information society. With the expansion of the internet, old information has become readily available and easily accessible, allowing for its retrieval and dissemination even after a long period. The problem has ceased to involve only the initial publication of a given fact and has come to encompass the permanence and reuse of information in the digital environment.
In the Brazilian legal system, the doctrinal formation of the right to be forgotten is based, especially, on the principle of the dignity of the human person, provided for in Article 1, III, of the Federal Constitution, and on the protection of privacy, private life, honor, and image, established by Article 5, X. These rights constitute important foundations for the protection of personality against undue or disproportionate exposure.
A significant milestone in Brazilian legal doctrine occurred in 2013, during the VI Civil Law Conference promoted by the Federal Justice Council, when Statement No. 531 was approved, according to which “the protection of the dignity of the human person in the information society includes the right to be forgotten” (CJF, 2013). This statement represented a relevant contribution to the development of the concept in Brazil, recognizing the need to protect dignity in the face of the permanence of information in the digital environment. However, its formulation did not confer an absolute character to the right to be forgotten; its application must be compatible with other fundamental rights and guarantees.
2.2 The Thesis Established by the STF (RE 1.010.606 / Theme 786)
The conceptual evolution of the right to be forgotten underwent a significant change in February 2021, when the Supreme Federal Court judged Extraordinary Appeal No. 1,010,606, under the general repercussion system, establishing the thesis corresponding to Theme 786. The specific case involved the television broadcasting of facts related to the crime that victimized Aída Curi, raising the question of the limits between the protection of personality rights and the freedoms of expression and information (STF, 2021).
When considering the matter, the Supreme Federal Court (STF) ruled out the existence of a general right to be forgotten that would allow, solely due to the passage of time, the prevention of the dissemination of truthful facts or data lawfully obtained and published by the media. The Court understood that such a generic recognition would be incompatible with the freedoms of expression and of the press and with the right to information (STF, 2021).
The general repercussion thesis established by the Supreme Federal Court established:
“The idea of a right to be forgotten, understood as the power to prevent, due to the passage of time, the dissemination of truthful facts or data lawfully obtained and published in analog or digital media, is incompatible with the Constitution. Any excesses or abuses in the exercise of freedom of expression and information must be analyzed on a case-by-case basis, based on constitutional parameters – especially those relating to the protection of honor, image, privacy, and personality in general – and the express and specific legal provisions in the criminal and civil spheres.”
The decision, however, did not eliminate specific rules that establish limits for the retention and use of information. In the consumer protection context, Article 43 of the Consumer Protection Code establishes a maximum period of five years for maintaining negative information and prevents, after the debt has prescribed, the provision of information that may hinder access to credit (BRAZIL, 1990). Similarly, the LGPD provides for special cases of deletion of personal data, specifically in Articles 16 and 18, VI (BRAZIL, 2018).
Thus, Topic 786 removed a general right to be forgotten based solely on the passage of time, but did not eliminate specific legal mechanisms for protecting and limiting information. This distinction is especially relevant in credit relations, where the Consumer Protection Code (CDC) establishes its own limits for registries and databases, while systems such as credit scoring have a distinct nature, an aspect that will be explored in more detail later.
3. THE RIGHT TO BE FORGOTTEN IN THE CONSUMER SPHERE: DATA DELETION IN THE CONSUMER PROTECTION CODE
The protection of consumers’ personal information occupies a prominent position in the Consumer Protection Code, especially given the use of data for risk analysis and credit granting. In this context, so-called consumer files encompass different forms of storage and organization of information related to consumers, including databases and registers used to record financial and credit information.
Credit protection agencies, such as Serasa, SPC, and Quod, collect, store, and make available information related to consumers’ financial history, playing an important role in risk assessment and credit granting. Although these mechanisms are legitimate and relevant to the functioning of the market, their use must observe the limits established by consumer protection legislation, especially regarding the quality, transparency, and permanence of information.
In this sense, Article 43, paragraph 1, of the Consumer Protection Code guarantees consumers access to information existing in registers, files, records, and personal and consumption data archived about them, as well as their respective sources. This provision represents an important control instrument, as it allows consumers to know what information is being used about them and to take the necessary measures in the face of incorrect, outdated, or improperly maintained data.
It is in this context that the discussion about the so-called right to be forgotten becomes relevant in consumer relations. Although there is no general right to be forgotten recognized by the Supreme Federal Court, the legal system establishes specific limits for the preservation and use of certain information. In the consumer context, these limits seek to prevent negative information from being used indefinitely or in a manner inconsistent with its legitimate purpose to restrict the consumer’s access to credit, preserving the balance between market protection and the consumer’s personality rights.
3.1 The Temporal Limitation of Default History: Analysis of Article 43, §§ 1 and 5, of the Consumer Protection Code
The Consumer Protection Code, since its creation in 1990, has consolidated mechanisms aimed at protecting consumers as the vulnerable party in consumer relations. Among these, the regulation of consumer databases and registries stands out; these are part of the category known as consumer files and play an important role in the credit market.
The term “consumer files” has come to be used to designate the different ways of storing information about consumers. As Antônio Herman Benjamin explains:
The Consumer Protection Code, in listing the commercial practices covered by its regulations, generically included them in order to encompass all forms of storing consumer information, whether private or public, for the supplier’s personal use or open to third parties […].
Given the importance of these records for granting credit, the legislator chose not to prohibit the existence of consumer databases and registries, but to establish rules for their use, seeking to balance market interests with consumer protection. As Norat (2026) points out, the regulation of this information was the alternative adopted by the Consumer Protection Code in the face of the need to provide greater security to consumer relations without allowing abusive practices. In this sense, Article 43 of the CDC ensures consumers access to information existing in their name and establishes rules for its maintenance.
This provision stipulates in its §1 that registries and databases cannot contain negative information relating to a period exceeding five years. The counting of the term begins the day after the debt’s due date, according to the understanding consolidated by the Superior Court of Justice (STJ) in Precedent 548. The rule seeks to prevent the creditor’s delay in registering the information from unduly prolonging the effects of the restriction.
Furthermore, paragraph 5 of article 43 establishes that, once the statute of limitations for debt collection has expired, no information will be provided that could prevent or hinder new access to credit. Thus, the protection afforded by the Consumer Protection Code (CDC) is not limited to the five-year period, and the legal status of the obligation and the effects that the information continues to produce on the consumer must also be considered.
The time limitation on negative information does not stem from a general right to be forgotten, but from specific rules established by consumer protection legislation. This understanding is consistent with Supreme Court Ruling 786, which rejected the existence of a general right to be forgotten based solely on the passage of time, without precluding the application of specific rules that establish limits for the retention and use of information.
Therefore, once the limits established in Article 43 of the Consumer Protection Code (CDC) are exceeded, negative information cannot continue to be used to produce restrictions that the legislation itself sought to prevent. This rule allows for a balance between the legitimate use of credit protection mechanisms and the need to prevent negative information from producing restrictive effects indefinitely.
3.2 Limits to Data Retention: The Illegality of Parallel Registries and Permanent Registration Restrictions
The expansion of consumer relations and the massification of contracts made it necessary to create mechanisms for credit analysis and granting. In this context, Norat (2026) highlights that, given the relevance of these records to the functioning of the market, the Consumer Protection Code did not prohibit the existence of consumer databases and registers, but established rules for their use, seeking to reconcile them with the protection of privacy, private life, honor, and image.
This possibility, however, is not unlimited. The maintenance of negative information is subject to the time limits established by law, so that, once the legal period has expired, the record cannot continue to produce restrictive effects. As Norat (2026) observes, there is a time limit that must be strictly observed, and it is not legitimate, once the legal period has expired, for the restriction to remain or to be used to hinder the consumer’s access to credit. Negative information cannot remain in the registers for a period exceeding five years, counted from the date the debt originated. After this period, the consumer must be removed from the register, and no new registration based on the same debt is admissible.
In this regard, the use of mechanisms designed to circumvent the limits established by the Consumer Protection Code, such as parallel databases or hidden records, also deserves attention. The use of old information to prolong the effects of a restriction that has already been overcome may represent a distortion of the purpose of databases and a violation of the protection afforded to the consumer.
The Brazilian Consumer Protection Code (CDC) itself establishes control mechanisms over this information, ensuring consumers access to existing data in their name and the possibility of demanding its correction when it is incorrect. Therefore, the time limitation of records should not be understood merely as an exclusion rule, but as an instrument designed to prevent outdated or legally superseded information from continuing to produce negative effects.
Thus, consumer protection seeks to prevent a legally limited restriction in time from being transformed, through direct or indirect mechanisms, into a permanent limitation on access to credit. Analyzing this issue is relevant to differentiating delinquent debtor registries from other forms of use of financial information, especially risk assessment systems, which will be examined later.
3.3 Transparency, Objective Good Faith, and the Right to a Financial Restart
Objective good faith is an important parameter for consumer protection in credit relations. This principle requires actions guided by loyalty, cooperation, and respect for the legitimate interests and expectations of the other party, prohibiting abusive behaviors capable of causing excessive harm or disadvantage. In the Consumer Protection Code, it is enshrined in Article 4, III, as a guiding principle for consumer relations, and in Article 51, IV, as a parameter for controlling abusive practices and clauses.
Transparency also requires that the information held in the records be clear, correct, and intelligible. As Norat (2026) explains, it is not sufficient for the consumer to have access to the data when it is presented through incomprehensible codes, the meaning of which is known only to those responsible for the record. The author exemplifies that a record that only indicates that the consumer falls under “code ten, blue situation,” without any clarification about the meaning of this classification, would be invalid.
Furthermore, registrations based on incorrect information are not permitted and must be corrected. Prior notification of registration is also an essential guarantee, as established by Precedent 359 of the Superior Court of Justice (STJ), allowing the consumer to become aware of the restriction and, when applicable, contest it.
Another relevant aspect concerns updating information after payment or renegotiation of debt. The consumer’s situation must correspond to the reality of the existing obligation; maintaining information that no longer reflects their current condition is not legitimate.
In the field of civil liability, wrongful registration can give rise to compensation for moral damages, especially when it affects the honor and credibility of the consumer. In certain cases, the Superior Court of Justice (STJ) recognizes the existence of damage in re ipsa , dispensing with the need to demonstrate concrete harm. This protection, however, is limited by STJ Precedent 385, according to which the existence of a legitimate pre-existing annotation can preclude compensation for moral damages arising from a new irregular registration, while maintaining the right to cancel the wrongful registration.
These limitations relate to the protection of what is called a “financial restart,” understood in this work as the possibility for the consumer not to remain indefinitely subjected to the negative effects of information that has already exceeded the legal limits of use.
Once the legal period for maintaining negative information has expired or the statute of limitations has run, and considering the circumstances outlined in Article 43 of the Consumer Protection Code (CDC), the data cannot continue to be used to create restrictions incompatible with the law. The transfer or assignment of the debt to third parties, in itself, should also not be used as a mechanism to artificially prolong the restrictive effects of the information.
Thus, objective good faith, transparency, and the temporal limitation of records work together to protect the consumer. On the one hand, the aim is to preserve the legitimacy of credit protection mechanisms and, on the other, to prevent incorrect, outdated, or legally superseded information from continuing to produce negative effects indefinitely. This protection constitutes an important foundation for the analysis, in the following sections, of the different mechanisms for handling credit information.
4. THE DIALOGUE OF SOURCES: CDC, LGPD AND THE INTERNET CIVIL FRAMEWORK
The increasing digitalization of consumer relations demands an integrated reading of the regulations governing consumer protection and personal data. With the intense circulation of information in the digital environment, the resolution of normative conflicts does not necessarily depend on the exclusion of one rule in favor of another, but can occur through the coordinated and complementary application of different legal instruments, according to the theory of the Dialogue of Sources.
In the field of data protection, this integration occurs especially between the Consumer Protection Code (Law No. 8,078/1990), the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014), and the General Data Protection Law (Law No. 13,709/2018). These regulations have their own purposes, but they can work together to protect consumers and their personal data, considering their vulnerability in consumer relations.
While the Consumer Protection Code (CDC) established mechanisms for consumer protection and regulated databases and registries, the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet) established rights and guarantees for the digital environment, and the General Data Protection Law (LGPD) consolidated general rules for the processing of personal data. The joint application of these legal instruments allows for broader protection of consumer information, especially regarding transparency, data control, and the limits of its use.
4.1 The Brazilian Internet Bill of Rights (Law No. 12.965/2014) and the Digital Consumer
The expansion of social networks has transformed virtual environments into spaces not only for interaction, but also for the offering and marketing of products and services, giving rise to what is called social commerce . In this context, Barreto (2015) highlights the need to legally analyze these new consumer relations, especially given the particularities of the digital environment.
The Brazilian Internet Bill of Rights (Marco Civil da Internet) establishes important guidelines for this protection and should be interpreted in conjunction with the Consumer Protection Code. As Barreto (2015) observes, Law No. 12.965/2014 outlines general guidelines and relevant principles for consumer protection in the digital environment. The law itself establishes consumer protection as one of the guidelines related to the regulation of internet use in Brazil and ensures the application of consumer protection and defense rules to consumer relations conducted on the internet (Article 7, XIII) (BRAZIL, 2014). Therefore, consumer relations conducted through the internet must observe the joint application of both legal instruments.
This integration becomes even more relevant when the consumer relationship involves the processing of personal data. Far from representing a conflict between norms, the simultaneous application of the Brazilian Internet Bill of Rights and the Consumer Protection Code demonstrates the application of the dialogue of sources. As Cláudia Lima Marques (2003) teaches, this construction allows for the harmonious, coordinated, and complementary application of different legislative instruments aimed at protecting the same legal subject.
In this sense, the rights guaranteed to users by the Brazilian Internet Bill of Rights (Marco Civil da Internet), especially those related to privacy and data protection, establish a direct connection with the principles and rights provided for in the Consumer Protection Code. This articulation contributes to a broader protection of the consumer in the digital environment, requiring transparency and clear information regarding the collection and use of their personal data.
The protection afforded by the Civil Rights Framework for the Internet also relates to the duty to inform, especially through Article 7, VIII, which ensures users receive clear and complete information about the collection, use, storage, and processing of their personal data. Together with the provisions of the Consumer Protection Code, this regulation contributes to strengthening transparency in consumer relations conducted in the digital environment (MENDES, 2016).
Thus, consumer protection in social commerce is not limited to purchase and contracting relationships, but also extends to how platforms and suppliers collect, use, and store consumer information. In this scenario, a joint interpretation of the Consumer Protection Code, the Brazilian Civil Rights Framework for the Internet, and the General Data Protection Law becomes necessary.
4.2 Complementarity between the CDC and the LGPD (Law No. 13.709/2018)
The enactment of the General Data Protection Law (Law No. 13.709/2018) broadened the legal protection afforded to personal data in Brazil, without excluding the application of the Consumer Protection Code. On the contrary, the two legal instruments act in a complementary manner, especially given the vulnerability of consumers in the digital environment.
Given this, the LGPD itself establishes consumer protection as the foundation of personal data protection (article 2, VI) and enshrines principles that directly relate to consumer protection, such as purpose, adequacy, necessity, transparency, and security (article 6). Therefore, data processing carried out by suppliers must comply with both the LGPD regulations and the rights established by the Consumer Protection Code (CDC).
This complementarity can also be observed in the rights guaranteed to the data subject. Article 18 of the LGPD (Brazilian General Data Protection Law) guarantees access, correction, deletion, and information regarding data sharing. These guarantees complement the right to information provided for in the Consumer Protection Code and reinforce the need for transparency in the relationships established between consumers and suppliers.
In the context of registries and databases, this relationship becomes even more evident. While Article 43 of the Consumer Protection Code (CDC) establishes rules for the creation and maintenance of consumer registries, ensuring access to information and imposing limits on the retention of negative data, the LGPD (Brazilian General Data Protection Law) establishes broader rights related to the control and processing of personal data, allowing consumer protection to be analyzed also from the perspective of data protection.
The combined application of the regulations is also relevant in the face of security breaches and data leaks. In these situations, the responsibility of suppliers must be analyzed considering both the provisions of the LGPD (Brazilian General Data Protection Law) and the liability regime foreseen in the Consumer Protection Code. Article 45 of the LGPD, in this sense, establishes that cases of violation of the data subject’s rights within the scope of consumer relations remain subject to the liability rules foreseen in the relevant legislation.
Thus, the use of personal data in consumer relations is not an activity outside the scope of consumer protection. The joint action of the CDC (Consumer Protection Code) and the LGPD (Brazilian General Data Protection Law) therefore allows for more comprehensive consumer protection, especially in light of the risks arising from data processing in the digital environment (AGRELLA; SILVA, 2023).
5. Case Law from the Superior Courts
The analysis of temporary data protection and consumer privacy protection requires a rigorous examination of the national case law. The understanding of the Superior Courts has played a decisive role in setting the parameters for calculating the time limits for negative credit reporting, in regulating risk assessment tools, and in combating the maintenance of veiled restrictions in the financial market.
5.1 Irregular Registration and Time Limits for Entries in Debtors’ Registers
Considering the content of Precedent 385 of the Superior Court of Justice, some courts have rejected the consumer’s right to compensation in cases of irregular entries in credit protection databases when a legitimate entry already exists, reserving, however, the right to cancel the improper entry. However, the aforementioned Court has taken the following position:
SPECIAL APPEAL. OMISSION. NON-OCCURRENCE. MORAL DAMAGES. NOT CHARACTERIZED. UNDUE REGISTRATION ORDERED BY THE ALLEGED CREDITOR. PREVIOUS ENTRIES. STJ PRECEDENT 385. 1. The appealed judgment analyzed all the issues necessary to resolve the controversy, and no omission or denial of jurisdictional service was found. 2. “No compensation for moral damages is due for an irregular entry in a credit protection register when a legitimate entry already exists, without prejudice to the right to cancellation” (STJ Precedent 385). 3. Although the precedents of the aforementioned summary judgment were rulings in which compensation was sought against restrictive credit registries, its rationale – “whoever is already registered as a bad payer cannot feel morally offended by yet another entry of their name as delinquent in credit protection registries”, cf. REsp 1.002.985-RS, rapporteur Minister Ari Pargendler – also applies to actions directed against the alleged creditor who carried out the irregular registration. 4. In this case, the undue registration coexisted with fourteen other entries that the lower courts verified to be in the plaintiff’s name in a delinquent registry. 5. Special appeal denied. (REsp No. 1,386,424/MG, rapporteur Justice Paulo de Tarso Sanseverino, rapporteur for the judgment Justice Maria Isabel Gallotti, Second Section, decided on April 27, 2016, published in the Official Gazette on May 16, 2016.)
It is clear from the above ruling that Summary 385 of the Superior Court of Justice (STJ) conditions the exclusion of compensation for moral damages arising from improper registration on the existence of a legitimate and pre-existing entry in the defaulters’ register. In Special Appeal No. 1,386,424/MG, the Court established the understanding that, although the new registration is irregular, the presence of legitimate prior records precludes the establishment of moral damages, while preserving the right to cancel the improper entry.
This guidance can also be observed in a more recent ruling by the Superior Court, in which the aforementioned precedent was again applied in light of the existence of other negative entries:
CONSUMER LAW. APPEAL IN SPECIAL APPEAL. DECLARATORY ACTION OF NON-EXISTENCE OF DEBT COMBINED WITH COMPENSATION FOR MORAL DAMAGES. COMPETENCE OF THE STATE COURT AND PASSIVE LEGITIMACY OF THE FINANCIAL AGENT. APPEAL IN SPECIAL APPEAL DISMISSED. I. CASE UNDER EXAMINATION […] 2. The controversy concerns a declaratory action of non-existence of debt combined with compensation for moral damages filed for the removal of an undue entry in credit restriction registers and condemnation for moral damages. 3. The first instance court partially granted the requests. It declared the non-existence of the debt related to Contract No. 434007263, in the amount of R$ 16,698.34; made the preliminary injunction definitive; recognized reciprocal defeat; and set attorney’s fees. 4. The court of origin upheld the judgment in its entirety. It recognized the negative credit reporting as improper due to the absence of a contract and valid proof; applied Article 14 of the Consumer Protection Code; and upheld the denial of moral damages based on Precedent 385 of the Superior Court of Justice (STJ). The motions for clarification were partially granted. II. ISSUE UNDER DISCUSSION 5. There are four issues under discussion: (i) whether Articles 2 and 3 of Law No. 10.260/2001 remove the passive legitimacy of the financial agent and attract the jurisdiction of the Federal Court; (ii) whether Article 20-B of Law No. 10.260/2001 imposes necessary joinder with the National Fund for Educational Development (FNDE); (iii) whether Article 12 of the Consumer Protection Code removes objective liability due to the absence of a service defect; and (iv) to determine whether Article 14 of the Consumer Protection Code was improperly applied in light of negative entries based on system screens. III. REASONS FOR DECISION 6. Summary Judgment No. 42 of the Superior Court of Justice (STJ) applies to affirm the jurisdiction of the State Courts in cases where a mixed-economy company is liable for improper registration in defaulter databases. 7. Summary Judgment No. 7 of the STJ applies when the acceptance of the arguments requires a re-examination of the factual and evidentiary record regarding the existence and regularity of the contract and passive legitimacy. IV. DECISION AND ARGUMENT 8. Appeal in special appeal dismissed. Judgment thesis: “1. Precedent No. 7 of the Superior Court of Justice (STJ) applies when the acceptance of the appeal arguments requires a re-examination of the factual and evidentiary record regarding the existence and regularity of the contract and passive legitimacy. 2. Precedent No. 42 of the STJ applies to affirm the competence of the State Court in cases where the financial agent, a mixed-economy company, is liable for improper registration in defaulter databases.” Relevant provisions cited: Federal Constitution, arts. 105 and 109; Law No. 10.260/2001, arts. 2, 3 and 20-B; Consumer Protection Code (CDC), arts. 12 and 14; Code of Civil Procedure (CPC), arts. 85, §§ 2 and 11, and 373, II. Relevant jurisprudence cited: STJ, Precedent No. 7; STJ, Precedent No. 42; STJ, Precedent No. 211; STJ, AgInt in AREsp No. 2,008,272/SP, rapporteur Justice Marco Buzzi, Fourth Panel, decided on 05/29/2023. (AREsp No. 3,085,517/BA, rapporteur Justice João Otávio de Noronha, Fourth Panel, decided on 06/30/2026, DJEN of 07/06/2026.)
It is noticeable that the judgments above demonstrate that STJ Precedent 385 conditions the exclusion of compensation for moral damages arising from improper registration on the existence of a legitimate and pre-existing entry in the defaulters’ register.
However, the protection afforded to consumers is not limited to the possibility of compensation for moral damages resulting from improper registration. It is also necessary to analyze the time limits established for maintaining information in credit protection databases, especially in light of the provisions of Article 43, §§ 1 and 5, of the Consumer Protection Code.
In this regard, the Superior Court of Justice has a consolidated understanding regarding the need to observe time limits for maintaining negative information in the registers of defaulters:
SPECIAL APPEAL. CIVIL PROCEDURE AND CONSUMER LAW. PUBLIC CIVIL ACTION. CREDIT PROTECTION. DATA. PROTEST REGISTRIES. PRINCIPLE OF PURPOSE. PRINCIPLE OF TRUTH OF INFORMATION. ART. 43 OF THE CDC (CONSUMER PROTECTION CODE). DEADLINES FOR MAINTAINING INFORMATION IN THE DEBTORS’ REGISTER. DEBT PRESCRIPTION. STARTING POINT. RESPONSIBILITY OF THE ARCHIVING INSTITUTION. OBLIGATION NOT TO DO. PRACTICAL RESULT EQUIVALENT TO PAYMENT. ART. 84 OF THE CDC. MORAL DAMAGES. LIMITATION. JUDGMENT. NATIONAL SCOPE. […] 2. In this public civil action, the issue is whether the defendants are failing to comply with the provisions of Article 43, §§ 1 and 5, of the Consumer Protection Code (CDC), by maintaining the registration of consumers’ names in their defaulter databases for a period exceeding five years from the due date of the debt, since they do not carry out any control over the statute of limitations and the respective starting point of the data originating from protest registries. […] 4. The purpose of the appeal is to determine the starting point of the time limit provided for in § 1 of Article 43 of the CDC and who is responsible for verifying the maximum period of permanence of the registration in credit protection databases, and the possibility of establishing compensable moral damages. […] 6. In view of the tension with personality rights and the dignity of the human person, the CDC, regulating the matter, attributed a public character to archiving entities, in order to institute a broad, rigorous and public control of their operations, in the interest of the community. […] 8. The registered data of consumers must be objective, clear and true, given that outdated or inaccurate information hinders the effective protection of credit and harms the economic activity of both the consumer and the supplier. 9. Entities maintaining credit registers must be jointly liable with the source and the consultant for the inaccuracy of the information contained in their files and for the damages that may cause harm to consumers (Article 16 of Law 12.414/2011). 10. In obligations to perform in Consumer Law, the judge must grant specific performance of the obligation or determine measures that ensure a practical result equivalent to fulfillment (Article 84 of the CDC). 11. The jurisprudence of the Superior Court of Justice (STJ) reconciles and harmonizes the deadlines of § 1 with that of § 5 of article 43 of the Consumer Protection Code (CDC), establishing that maintaining a negative entry in credit protection databases respects the enforceability of the unpaid debt, having, for this purpose, a maximum limit of five years which may, however, be restricted if the limitation period for collecting the debt is shorter. 12. Due to respect for the enforceability of the debt and the principle of truthfulness of information, the starting point of the five-year time limit in which the debt may be registered in the default database is counted from the first day following the debt’s due date. 13. The time limit for maintaining the information in article 43, § 1,14. The Consumer Protection Code (CDC) is examined separately in relation to each entry. 15. Archivists must adopt a position that avoids potential harm to the consumer’s personality rights, which is why it is legitimate to impose an obligation not to include in their database information collected from protest registries without information on the debt’s due date, in order to control both time limits established in Article 43 of Law 8.078/90. 16. Generic condemnation of the respondents to indemnify for material damages and to compensate for moral damages individually suffered by consumers, provided that it is proven that all entries in their names are outdated. 17. Scope of the decision rendered in a collective action throughout the national territory, respecting the objective and subjective limits of what was decided. Repetitive understanding. 18. Special appeal granted. (REsp No. 1,630,659/DF, rapporteur Justice Nancy Andrighi, Third Panel, decided on 11/9/2018, published in the Official Gazette on 21/9/2018.)
The case demonstrates the Court’s concern for consumer dignity and the responsibility of credit reporting agencies for inaccurate data (article 43 of the Consumer Protection Code). The decision reinforces that the maximum five-year period for including a name in credit reporting agencies begins the day after the debt becomes due, and is limited to the statute of limitations for the debt itself, if that period is shorter.
Thus, the judgments analyzed demonstrate that the protection afforded to the consumer involves both the right to cancel improper entries and the observance of time limits for maintaining negative information in credit protection databases.
While STJ Precedent 385 governs the effects of the existence of legitimate pre-existing entries on claims for compensation for moral damages, Article 43 of the Consumer Protection Code establishes its own limits for the retention of information in credit reporting databases. This distinction is relevant for understanding the legal limits imposed on the processing of credit information and for the analysis, in the following sections, of the non-perpetuation of consumer data.
5.2 Credit Scoring and the limits of processing consumer information according to the STJ (Superior Court of Justice)
The Superior Court of Justice (STJ) consolidates its understanding that credit scoring is a lawful statistical method for assessing credit risk, and that prior consumer consent is not required (Topic 710 and Summary 550/STJ). The STJ establishes a fundamental distinction: credit scoring is not the same as databases of defaulters, having its own nature and purposes.
However, the waiver of consent does not equate to authorization for the unrestricted processing of data or its indiscriminate circulation. Risk analysis activity must strictly observe the principles of transparency, quality, adequacy, and relevance of information (Article 6 of the LGPD and guidelines of the CDC), ensuring the consumer’s right to request clarification on the sources and elements considered in its calculation, as well as to contest incorrect or inadequate data.
The legality of the statistical method, therefore, does not endorse the continued use of information that is no longer relevant to credit risk assessment, imposing the establishment of material and temporal limits for consumer protection. Ultimately, risk analysis must operate within reasonable parameters, preventing the scoring system from becoming a purely punitive instrument.
5.3 The “forgetfulness” in the internal scoring of banking institutions: limits to the use of past information
Based on the parameters established by the Superior Court of Justice (STJ), the legitimacy of using outdated information in internal risk systems of financial institutions ( internal score ) is questioned. Although Article 43, §§ 1 and 5, of the Consumer Protection Code (CDC) establishes that registers of defaulters cannot maintain negative data for more than five years or data relating to time-barred debts, these limits do not automatically apply to the internal score , given the difference in legal nature between the systems.
This analysis should also consider Supreme Court Ruling 786, which rejected the general right to be forgotten based solely on the passage of time. However, the absence of an automatic obligation to delete data after five years does not grant banking institutions unrestricted freedom to perpetuate past records.
The central problem lies in the disproportionate retention of old data or prescribed obligations that continue to negatively impact credit granting without a legitimate justification of risk. In these cases, the indefinite use of historical data produces practical effects comparable to those of a perpetual restrictive registry, violating objective good faith and requiring the establishment of time limits for the use of this information in the banking sector. It is concluded, therefore, that the reasonableness and temporal relevance of the data should prevail over the indefinite retention of consumer history.
6. FINAL CONSIDERATIONS
This research has shown that the protection of consumer information has limits established by the legal system itself, especially in the context of credit registries and databases. Long before the advent of the General Data Protection Law (Law No. 13.709/2018) and the Marco Civil da Internet (Law No. 12.965/2014), the Consumer Protection Code (Law No. 8.078/1990) already established time limits for maintaining negative information, seeking to prevent the perpetuation of the effects of past financial situations.
The analysis of Topic 786 by the Supreme Federal Court indicated that there is no general right to be forgotten applicable to the disclosure of truthful and lawfully obtained facts. This conclusion, however, does not preclude the application of specific rules that establish limits for the retention and use of information. In this sense, the five-year period for maintaining negative information and the prohibition provided for in Article 43, §§ 1 and 5, of the Consumer Protection Code constitute specific mechanisms for protecting consumers against the perpetuation of credit restrictions.
It was also found that the protection of consumer information must be understood through a dialogue between the Consumer Protection Code (CDC), the General Data Protection Law (LGPD), and the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet). The complementary action of these legal instruments reinforces the duties of transparency, security, information, and good faith in the processing of personal data, without disregarding the particularities and limits established in each piece of legislation.
The analysis of credit scoring also demonstrated that its legal nature is not the same as that of defaulter registries. According to Topic 710 and Summary 550 of the Superior Court of Justice (STJ), the score constitutes a statistical method of risk assessment, and its use, in itself, does not depend on the consumer’s prior consent. However, this exemption does not represent authorization for unlimited use of the information. The use of old, incorrect, inadequate, or irrelevant data can, under certain circumstances, produce effects similar to those of a credit restriction, especially when used for a prolonged period to hinder access to credit.
Thus, the research concludes that the protection afforded by the Consumer Protection Code (CDC) does not correspond to a general right to be forgotten, but rather establishes limits on the retention and use of certain consumer information. The contemporary challenge lies precisely in ensuring that legitimate risk assessment mechanisms are not used to perpetuate the effects of past financial situations that no longer have relevance or legal basis.
REFERENCES
AGRELLA, Jefferson; SILVA, Alexandre Almeida da. A aplicação suplementar do CDC à LGPD. Migalhas, De Peso, 30 mar. 2023. Disponível em: https://www.migalhas.com.br/depeso/383748/a-aplicacao-suplementar-do-cdc-a-lgpd. Acesso em: 12 ago. 2026.
BARRETO, Ricardo Menna. Proteção do consumidor no comércio social eletrônico: observações à luz da Lei 12.965/2014 (Marco Civil da Internet). Direito & TI – Debates Contemporâneos, Porto Alegre, n. 2, p. 1-5, 2015.
BENJAMIN, Antônio Herman et al. O Código Brasileiro de Defesa do Consumidor Comentado. 8. ed., p. 415-416.
BRASIL. Constituição da República Federativa do Brasil de 1988. Brasília, DF: Presidência da República, 1988.
BRASIL. Lei nº 8.078, de 11 de setembro de 1990. Dispõe sobre a proteção do consumidor e dá outras providências. Brasília, DF: Presidência da República, 1990.
BRASIL. Lei nº 12.965, de 23 de abril de 2014. Estabelece princípios, garantias, direitos e deveres para o uso da Internet no Brasil. Brasília, DF: Presidência da República, 2014.
BRASIL. Lei nº 13.709, de 14 de agosto de 2018. Lei Geral de Proteção de Dados Pessoais (LGPD). Brasília, DF: Presidência da República, 2018.
BRASIL. Superior Tribunal de Justiça. Agravo em Recurso Especial nº 3.085.517/BA. Relator: Ministro João Otávio de Noronha. Quarta Turma. Julgado em: 30 jun. 2026. DJEN, 6 jul. 2026.
BRASIL. Superior Tribunal de Justiça. Recurso Especial nº 1.386.424/MG. Relator: Ministro Paulo de Tarso Sanseverino. Relatora para acórdão: Ministra Maria Isabel Gallotti. Segunda Seção. Julgado em: 27 abr. 2016. DJe, 16 maio 2016.
BRASIL. Superior Tribunal de Justiça. Recurso Especial nº 1.630.659/DF. Relatora: Ministra Nancy Andrighi. Terceira Turma. Julgado em: 11 set. 2018. DJe, 21 set. 2018.
BRASIL. Superior Tribunal de Justiça. Súmula nº 359. Brasília, DF: Superior Tribunal de Justiça, [s. d.].
BRASIL. Superior Tribunal de Justiça. Súmula nº 385. Brasília, DF: Superior Tribunal de Justiça, [s. d.].
BRASIL. Superior Tribunal de Justiça. Súmula nº 548. Brasília, DF: Superior Tribunal de Justiça, [s. d.].
BRASIL. Superior Tribunal de Justiça. Súmula nº 550. Brasília, DF: Superior Tribunal de Justiça, [s. d.].
BRASIL. Supremo Tribunal Federal. Recurso Extraordinário nº 1.010.606/RJ. Relator: Ministro Dias Toffoli. Tema 786 da repercussão geral. Brasília, DF: Supremo Tribunal Federal, 2021.
CONSELHO DA JUSTIÇA FEDERAL. Enunciado nº 531 da VI Jornada de Direito Civil. Brasília, DF: CJF, 2013.
MARQUES, Claudia Lima. Contratos no Código de Defesa do Consumidor: o novo regime das relações contratuais. 4. ed. São Paulo: Revista dos Tribunais, 2003.
MENDES, Laura Schertel. O diálogo entre o Marco Civil da Internet e o Código de Defesa do Consumidor. Revista de Direito do Consumidor, São Paulo, v. 25, n. 106, p. 195-231, jul./ago. 2016.
NORAT, Markus Samuel Leite. Direito do consumidor descomplicado: passo a passo didático e prático. João Pessoa: Editora Norat, 2026.
[1] Especializanda em Direito Civil e Processual Civil pelo Centro Universitário de João Pessoa (UNIPÊ). Bacharela em Direito pelo Centro Universitário de João Pessoa (UNIPÊ). E-mail: laise7496@gmail,com
[2] Especializanda em Direito Civil e Processual Civil pelo Centro Universitário de João Pessoa (UNIPÊ). Bacharela em Direito pelo Centro Universitário de João Pessoa (UNIPÊ). E-mail: lorenasouzalimasl_03@outlook.com
[3] Doutorando em Ciências Jurídicas e Sociais. Mestre em Direito e Desenvolvimento Sustentável. Especialização em Coordenação Pedagógica. Especialização em Tutoria em Educação a Distância e Docência do Ensino Superior. Especialização em Direito da Seguridade Social Previdenciário e Prática Previdenciária. Especialização em Advocacia Extrajudicial. Especialização em Direito da Criança, Juventude e Idosos. Especialização em Direito Educacional. Especialização em Direito do Consumidor. Especialização em Direito Civil, Processo Civil e Direito do Consumidor. Especialização em Direito do Trabalho e Processual do Trabalho. Especialização em Direito Ambiental. Especialização em Desenvolvimento em Aplicações Web. Especialização em Desenvolvimento de Jogos Digitais. Especialização em Ensino Religioso. Especialização em Docência no Ensino de Ciências Biológicas. Especialização em Ensino de História e Geografia. Especialização em Ensino de Arte e História. Especialização em Docência em Educação Física. Licenciatura em Geografia. Licenciatura em Ciências Biológicas. Licenciatura em História. Licenciatura em Letras Português. Licenciatura em Ciências da Religião. Licenciatura em Educação Física. Licenciatura em Artes. Licenciatura em Ciências Sociais. Licenciatura em Filosofia. Bacharelado em Direito. Editor de Livros, Revistas e Websites. Advogado especializado em Direito do Consumidor. Coordenador Pedagógico e Professor do Departamento de Pós-Graduação em Direito do Centro Universitário de João Pessoa UNIPÊ; Professor convidado da Escola Nacional de Defesa do Consumidor do Ministério da Justiça; Professor do Curso de Graduação em Direito no Centro Universitário de João Pessoa UNIPÊ; Professor do Curso de Graduação em Direito na Faculdade Internacional Cidade Viva FICV; Membro Coordenador Editorial de Livros Jurídicos da Editora Edijur (São Paulo); Membro Diretor Geral e Editorial das seguintes Revistas Científicas: Scientia et Ratio; Revista Brasileira de Direito do Consumidor; Revista Brasileira de Direito e Processo Civil; Revista Brasileira de Direito Imobiliário; Revista Brasileira de Direito Penal; Revista Científica Jurídica Cognitio Juris, ISSN 2236-3009; e Ciência Jurídica; Membro do Conselho Editorial da Revista Luso-Brasileira de Direito do Consumo, ISSN 2237-1168; Autor de mais de 90 livros jurídicos e de diversos artigos científicos.