The date of 1 August 2021 brings an important milestone in the area of privacy and protection of personal data: the beginning of the possibility for the National Data Protection Authority - ANPD to start applying administrative sanctions under the General Law on Personal Data Protection (LGPD).
This implies that the penalties for non-compliance with the LGPD, ranging from warnings, a fine of up to two percent (2%) of the company's turnover - limited to BRL 50 million, per infraction, publication of the infraction, and even blocking and deletion of the personal data involved in the infraction; can already be addressed by the Authority. The sanctions only apply to events occurring after August 1, 2021 (with the exception of offences of a continuous nature that began before this date).
The ANPD has already positioned itself[1] in the sense that it will begin its sanctioning activities after the approval of the Regulation on Supervision and the Application of Administrative Penalties, which has yet to be deliberated by its Board of Directors.
It is important to note that the fact that the ANPD applies any of the penalties under its jurisdiction to companies does not exclude the possibility of other sanctions, also in the administrative sphere, by other public agencies (e.g. PROCON and Public Prosecutor's Office).
As for the ANPD's initial approach, it was explained that the effective application of sanctions will be preceded by an administrative procedure that allows for the broad defence and presentation of administrative appeals by the company, and that it must also take into account a gradual approach, linked to a monitoring plan that prioritizes topics according to their risk, seriousness, timeliness and relevance.
Finally, we remind you that the ANPD already has a channel for reporting violations of the LGPD, whose instructions can be accessed here.
[1] Available at: https://www.gov.br/anpd/pt-br/assuntos/noticias/sancoes-administrativas-o-que-muda-apos-1o-de-agosto-de-2021
