Whoever disrespects the General Data Protection Law (Law 13.709) may be punished. The standard was approved in 2018, had its validity started last year, but only now, as of August, will the sanctions for those who violate the rights of data subjects and the obligations for those who collect and process records come into effect.
The LGPD lists as possible sanctions warning, fine (daily or with a limit of up to 2% of the company’s revenue), blocking of personal data object of the violation, partial suspension of the functioning of the database and partial or total prohibition of the exercise of the related activity to data processing.
The Law establishes a set of rights for data subjects, such as informing what data is being collected and for what purposes, or not reusing the collected records for other purposes, with some exceptions. Companies also have a set of requirements, such as informing a person in case of security incident.
The supervision and application of punishments is the responsibility of the National Data Protection Authority (ANPD), a structure linked to the Presidency of the Republic. But execution still depends on the publication of a regulation on the subject, which will define the way in which the inspection will be carried out and the criteria for applying sanctions. ANPD placed a proposal in public consultation between May and June and received more than 1,800 contributions.
According to the director of the Miriam Wimmer Authority, the proposed regulation brought a gradual perspective that goes from monitoring possible violations to different degrees of intervention by the agency.
“We have foreseen certain procedures that must be observed, starting with a stage of monitoring complaints to identify the main problems, passing through stages of guidance, prevention and repression of infractions, culminating in the application of sanctions”, he explains.
The draft states, for example, the procedures for the initiation, assessment, decision and appeal of sanctions processes. According to the document, ANPD can close a process if the data handler who commits the violation repents and demonstrates that it stopped the practice. Another instrument is the firmament of conduct adjustment terms.
The application of fines will be subject to a specific rule, whose proposal is still under study within the ANPD. According to Wimmer, only after the approval of this regulation can the use of fines in punishment be adopted.
The president of the Data Protection and Privacy Commission of the Brazilian Bar Association of Rio de Janeiro, Estela Aranha, recalls that citizens who have found a violation in relation to their data can seek the company or body with the complaint, which should indicate the data protection officer and the person responsible for communication with data subjects.
The person can also resort to ANPD. “To file a complaint with ANPD, it is first necessary for the data subject to make his request to the processing agent. Once this is not attended to, the data subject may submit petitions to ANPD containing proof of the presentation of an unresolved claim to the controller”, he explains.
ANPD’s complaints channel was made available in a site specific.
Application of sanctions
In the assessment of the Association of Information and Communication Technology (ICT) and Digital Technology (Brasscom) Companies, amid the possible actions of various bodies that could apply punishments, ANPD should be the main one of them to carry out the inspection and activities of prevention and sanction.
The entity understands that the Authority must have an inducing role with a view to promoting legal certainty in the data processing activity and seeking to encourage social trust in the use of personal data.
“The authority needs to use educational skills to instruct what to do instead of inhibiting action. The damage cases take after an administrative process and verified the damage that there is in fact the respective sanction. But before reaching this sanctioning process, there must be a staggering”, says the Government Relations manager at the entity, Daniel Stivelberg.
For the director of the Data Privacy Brazil Research Association, Rafael Zanatta, a problem that still exists is the lack of classification of infractions (such as minor, medium and serious). There is also no clarity yet on elements that can attenuate or aggravate a possible sanction.
The researcher warns that there is a discourse propagated by companies that aims to raise a panic with the risk of high fines and possible damages from punishment to businesses, which should not happen. In addition, there is pressure from the private sector to ease sanctions, linking them to possible material damage.
“We defend the importance of bringing the centrality of the protection of rights and the type of violation from the perspective of people’s rights, collective rights. The idea would be to identify an offense based on the degree of damage to people’s rights, and not the consequence of material damage”, defends Zanatta.
Bia Barbosa, a member of the Rights on the Network Coalition and the Internet Steering Committee in Brazil, emphasizes that inspection and sanctions are essential for the LGPD to be effectively respected. According to her, the fact that it has only entered into force now, more than two years after the Law was passed, shows how there was pressure for this law enforcement capacity not to be fully utilized.
The creation of ANPD late, in the second half of 2020 also made the implementation of the law difficult, as the fact that sanctions came into force without the Authority’s regulation being published.
The representative of the Coalition is afraid of statements by ANPD members that sanctions should be avoided. “It is essential that ANPD works towards a culture of protection of personal data, both educational and that the processing agents actually incorporate the determinations in the law to stop continuous damages or mitigate episodes. Often, only after a tougher sanction can certain actors adapt their behavior to the LGPD”, argues Bia Barbosa.
+ Learn about the effectiveness of each vaccine against Covid-19