The General Data Protection Law (No. 13,709/2018) took effect in September 2020 with the exception of certain provisions concerning the National Data Protection Authority's (ANPD's) right to apply administrative penalties. In light of the covid-19 pandemic, Law No. 14,010/2020 extended the deadline for such penalties to take effect until 1 August 2021.
As of August 2021, the following penalties may be applied:
- a warning, with a specific deadline by which to adopt corrective measures;
- a one-time fine of up to 2% of the private legal entity or group's before-tax revenue in its preceding fiscal year in Brazil, limited to a total of 50 million reais per infraction;
- a daily fine, taking into account the limit mentioned above;
- the mandatory public disclosure of the infraction after its occurrence is confirmed;
- the blocking of the processing of the corresponding personal data until the infraction is corrected;
- the obligation to delete personal data corresponding to the infraction;
- a partial suspension of the database corresponding to the infraction for up to six months, until the adoption of corrective measures;
- the suspension of data processing corresponding to the infraction for up to six months, which can be renewed for the same amount of time; and
- the partial or total prohibition of exercising data processing operations.
When applying penalties, the ANPD will take the following criteria into account:
- the gravity and nature of the infractions, and the individual rights affected;
- whether the offender acted in good faith;
- the offender's financial situation;
- the potential for reoffending;
- the offender's cooperation in the matter;
- whether the offender has adopted internal mechanisms and procedures capable of minimising damage;
- whether best practice and governance policies have been adopted; and
- how quickly corrective measures were adopted.
The final three of the aforementioned penalties can be applied only after one of the other penalties has already been applied to the same case.
The ANPD has clarified that these penalties will apply only to infractions occurring from 1 August 2021, or for continuing violations that commenced prior to that date.
Further, the ANPD is currently in the final stages of developing its Regulation for Inspecting and Applying Administrative Sanctions, which includes steps for monitoring and guiding compliance, as well as preventing and penalising infractions. The methodology for applying fines is still subject to future public consultation.
For further information on this topic please contact Fabio Ferreira Kujawski, Paulo Marcos Rodrigues Brancher or Thiago Luís Sombra at Mattos Filho Veiga Filho Marrey Jr e Quiroga Advogados by telephone (+55 11 3147 7600) or email ([email protected], [email protected] or [email protected]). The Mattos Filho Veiga Filho Marrey Jr e Quiroga Advogados website can be found at www.mattosfilho.com.br.
An earlier version of this article was first published on Único.