ANPD applies first sanction for non-compliance with the General Data Protection Law

This Thursday, July 6, 2023, the Federal Official Gazette published the first sanction application decision issued by the National Data Protection Authority (“ANPD”) for non-compliance with the General Data Protection Law (“LGPD”).

The LGPD provides for a varied list of sanctions of administrative, pecuniary, and activity-restricting nature, ranging from warnings and fines to partial or total prohibition of the exercise of activities related to the processing of personal data. However, only in the beginning of this year, the ANPD approved its Dosimetry and Enforcement of Administrative Penalties Regulation, establishing the applicable parameters in its sanctioning activities, and thus allowing the application of sanctions to begin.

In this sense, the first sanctions of the history of the ANPD were applied within the scope of the Sanctioning Administrative Process nº 00261.000489/2022-62, namely: (i)  Warning (without imposition of corrective measures), for violating article 41 of the LGPD (which sets forth the obligation to indicate a DPO, as well as his/her identification and contact details); and (ii) Simple fine, in the amounts of R$ 7,200.00 (seven thousand and two hundred Brazilian reais) for violation of article 7 of the LGPD (which establishes the legal bases for the processing of personal data) and + R$ 7,200.00 (seven thousand and two hundred Brazilian reais) for violation of article 5 of the Inspection Regulation (CD/ANPD Resolution No. 1, of October 28, 2021), which lists certain conducts that the processing agent must observe during the inspection procedure (such as providing documents and information, allowing access to its facilities and information assets, conducting audits, and providing materials on the information systems used).

The punished company may appeal the decision that applied the sanctions within 10 (ten) business days. In case the company waives the right to appeal and settles the amount of the fines within 20 working days, it will be entitled to a reduction of 25% (twenty-five per cent) of the amount. On the other hand, if it chooses not to appeal and not to comply with the ANPD’s decision, the administrative proceeding will be sent to the ANPD’s Specialized Federal Attorney’s Office for the execution of the fine, under penalty of the punished company being included in the Federal Active Debt and in the Brazilian Informative Registry of Unpaid Credits of the Federal Public Sector (Cadin).

Undoubtedly, this decision of the General Inspection Coordination of the ANPD represents a historical milestone for the Brazilian data protection regulatory environment, demonstrating the need for a responsible and diligent commitment of all agents involved in the treatment of personal data.