> It is common to be asked for your CPF for trivial things like purchasing anything on a drugstore, and for any and all activity with government branches or banking. This combined with several breaches in government and private institutions in Brazil over the years has made this information essentially public.

It is common but it doesn't change the fact that the CPF (social security number) is personally identifiable information and any leak related to it or any use without reason is a breach of the LGPD.