News

The Brazilian General Data Protection (LGPD), Law 13.709/2018, came into force in September 2020, however, the administrative sanctions provided for in this legislation are scheduled to start in August 2021. The private sector must have special attention to the subject and be prepared to comply with the law, since non-compliance may lead to the application of pecuniary sanctions, as well as measures that have a reputational impact on companies.

According to the LGPD, data processing agents who commit violations of the legislation will be subject to administrative sanctions, which will be applied by the Brazilian National Data Protection Authority (ANPD), such as: (i) warning, with an indication of a deadline for the adoption of corrective measures; (ii) fine of up to 2% (two percent) of the company’s revenue in its last fiscal year, with a limit of 50 million reais per infraction, (iii) daily fine observing the limit mentioned in the previous item, (iv) publication of the infraction after its due investigation and confirmation of its occurrence, among others.

The application of sanctions will occur after an administrative procedure that provides broad defense to the processing agents responsible for non-compliance to the terms of the law.

In addition, the ANPD must apply some specific criteria, based on each specific case, when determining the applicable sanction, including: (i) the seriousness and nature of the violations and the affected personal rights, (ii) the good faith of the offender, ( iii) the advantage gained by the offender, (iv) its economic condition, (v) recurrence, (vi) the degree of damage caused, (vii) the offender’s cooperation and (viii) the repeated and demonstrated adoption by the offender of internal mechanisms and procedures capable of minimizing damage, aimed at the safe and proper treatment of data.