On August 1, 2021, the administrative sanctions provided for the Brazilian Data Protection Law (LGPD) - Law No. 13.709/2018 (the "Law") came into force and will be applied by the Brazilian Data Protection Authority (ANPD).

LGPD provides that data processing agents (controller and processor) who violate the rules provided for in the Law will be subject to:

  • Warning, indicating the deadline for taking corrective measures;
  • Simple fine, of up to 2 percent of the billing, excluding taxes, limited to BRL R$50 million per infraction;
  • Daily fine, limited to the total amount of BRL R$50 million per infraction;
  • Publicizing the infraction, after being investigated and confirmed;
  • Deletion of personal data related to the infringement;
  • Partial suspension of the functioning of the database to which the infringement refers until regularization;
  • Suspension of the exercise of data processing; and
  • Partial or total prohibition of the exercise of activities related to data processing.

Who the administrative sanctions apply to

Administrative sanctions apply to any Controller (natural or legal person, under public or private law, who is responsible for decisions regarding the processing of personal data) or Processor (natural or legal person, under public or private law, who carries out the processing of personal data on behalf of the controller).

Controllers and processors located in foreign territory are also subject to administrative sanctions, as the LGPD has extraterritorial application.

Parameters for applying administrative sanctions

LGPD provides that administrative sanctions will be applied after an administrative procedure that allows for the opportunity of ample defense, depending on the circumstances of each individual case and the following criteria:

  • Severity and nature of infringements and affected personal rights;
  • Violator's good faith;
  • Advantage gained or intended by the Violator;
  • Violator's economic condition;
  • Recurrence;
  • Degree of damage;
  • Violator cooperation;
  • Repeated and demonstrated adoption of internal mechanisms and procedures capable of minimizing damage, aimed at the safe and proper data processing;
  • Adoption of good practices and governance policy;
  • Adoption of corrective measures; and
  • Proportionality between the seriousness of the violation and the intensity of the sanction.

Conduct subject to administrative sanctions

Any non-compliance with obligations by the LGPD to the controllers and processors is subject to sanction by ANPD

ANPD's performance in sanctions

ANPD carried out a public consultation to prepare the Regulation for Inspection and Application of Administrative Sanctions, which is currently being concluded. In addition to such regulation, ANPD will also submit a specific rule to public consultation to deal with sanctions and dosimetry.

ANPD will start its sanctioning action after the approval of this regulation, acting in relation to facts that occurred after August 1, 2021, or for continuing violations initiated before that date.

Visit us at Tauil & Chequer

Founded in 2001, Tauil & Chequer Advogados is a full service law firm with approximately 90 lawyers and offices in Rio de Janeiro, São Paulo and Vitória. T&C represents local and international businesses on their domestic and cross-border activities and offers clients the full range of legal services including: corporate and M&A; debt and equity capital markets; banking and finance; employment and benefits; environmental; intellectual property; litigation and dispute resolution; restructuring, bankruptcy and insolvency; tax; and real estate. The firm has a particularly strong and longstanding presence in the energy, oil and gas and infrastructure industries as well as with pension and investment funds. In December 2009, T&C entered into an agreement to operate in association with Mayer Brown LLP and become "Tauil & Chequer Advogados in association with Mayer Brown LLP."

© Copyright 2020. Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. All rights reserved.

This article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.