As of August 1, 2021, the National Data Protection Authority (“Authority” or “ANPD”) may apply the administrative sanctions provided for in Law no. 13.709/2018 – General Data Protection Law (“LGPD”), for those individuals or legal entities, from the private or public sector, that do not comply with the LGPD.
The sanctions may be applied following an administrative procedure that will provide the opportunity for a full defense, in a gradual, single or cumulative manner, in accordance with the peculiarities of the particular case, and considering criteria and parameters such as: the severity and nature of the infractions and of the personal rights affected, the good faith and cooperation of the offender, the recidivism, the adoption of best practices and governance policies, among others.
Pursuant to the LGPD, the following sanctions may be applied:
- warning, with an indication of the time period for adopting corrective measures;
- one-time fine of up to two percent (2%) of the revenues of a private legal entity, or its group or conglomerate in Brazil, in the prior fiscal year, excluding taxes, limited to a total of fifty million Brazilian Reais (BRL 50,000,000.00) per infraction;
- daily fine, subject to the total maximum referred to item (2) above;
- public disclosure of the infraction once it has been duly ascertained and its occurrence has been confirmed;
- blocking of personal data to which the infraction refers to until the regularization;
- deletion of the personal data the infraction refers to;
- partial suspension of the operation of the database to which the infraction refers for a maximum period of six (6) months, renewable for the same amount of time until the controller’s processing operations are brought into compliance;
- suspension of the processing of the personal data to which the infraction refers for a maximum period of 6 (six) months, renewable for the same amount of time; and
- partial or total prohibition of exercising activities relating to data processing.
Costa e Tavares Paes Advogados is at your disposal for further clarification on data protection matters.