Brazil started the week with another milestone for privacy and data protection. On February 27, 2023, the Brazilian National Data Protection Agency (ANPD) published the Regulation on Dosimetry and Application of Administrative Sanctions, which establishes the criteria and parameters for applying penalties in case of violations of the Brazilian General Data Protection Law (LGPD).

From now on, the ANPD can apply the sanctions provided by law, including to the 8 ongoing processes. The regulation informs which parameters will be used by the authorities, ensuring due legal process and transparency of decisions.

The sanctions that can now be applied – provided in the LGPD – are:

• • Warning;

• • Simple fine of up to 2% of the company’s revenue (total limit of R$ 50,000,000.00 per infraction);

• • Daily fine (total limit of R$ 50,000,000.00);

• • Publication of the infraction;

• • Blocking of personal data;

• • Elimination of personal data;

• • Partial suspension of the operation of the database (maximum of 6 months, extendable for the same period, until the case is regularized);

• • Suspension from exercising the activity of processing personal data (maximum 6 months, extendable for the same period);

• • Partial or total prohibition from exercising activities related to data processing.

The sanctions will be applied on a case-by-case basis, analyzing the following criteria:

• • Seriousness and nature of the infractions and personal rights affected;

• • Good faith of the offender;

• • Advantage obtained or intended by the offender;

• • Economic condition of the offender;

• • Recidivism;

• • Extent of damage;

• • Cooperation from the offender;

• • Adoption of internal mechanisms and procedures capable of minimizing the damage;

• • Adoption of a policy of good practices and governance;

• • Prompt adoption of corrective measures; and

• • Proportionality between the seriousness of the violation and the intensity of the sanction.

Click here to access the full regulation (in Portuguese).

 

---