Anna Berredo comments in Estadão on the entry into force of LGPD sanctions

As of August 1st, the new LGPD administrative sanctions will come into effect. To discuss the matter, ESTADÃO listened to several experts, including Dr. Anna Luiza Berredo, partner in the TMT, Privacy & Data Protection area at Maneira Advogados. She assesses that “it is very important to understand that this regulatory modeling seeks a balance between positive and negative incentives while incorporating the principle of risk-based management as a guide for the ANPD's own activities.”

Lack of methodology for applying LGPD fines and sanctions to companies worries lawyers

Penalties imposed by the new legislation come into effect this coming Sunday, August 1st, for legal entities

Writing

July 28, 2021

As of August 1st, the administrative sanctions of the LGPD (General Personal Data Protection Law) will come into effect. From that date onwards, the National Data Protection Authority (ANPD) will be able to apply the measures provided for by law to companies that do not comply.

LGPD came into force on September 18, 2020. However, its fines and sanctions begin to be applied from the second half of 2021. Photo: Unsplash

Although the deadline is already running out, many companies and public bodies are still not fully adapted to the requirements of the LGPD. According to Juliano Maranhão, partner at Sampaio Ferraz Advogados and director of the LGPD Institute, there are still several topics to be regulated by the ANPD. “It would be beneficial if, at this beginning and period of implementation of the data protection culture, the ANPD adopted a milder dosimetry of penalties, with an educational nature”, says Maranhão.

On the 15th and 16th of July, the ANPD held public hearings to discuss the draft resolution on the inspection and application of sanctions by the National Authority, a draft that had already gone through a public consultation process in June of this same year.

For Anna Luiza Berredo, partner in the TMT, Privacy & Data Protection area at Maneira Advogados, the ANPD has been seeking to debate, in a transparent manner, what would be the appropriate inspection and sanctioning mechanisms capable of ensuring companies' awareness. "It is very important to understand that this regulatory modeling seeks a balance between positive and negative incentives while incorporating the principle of risk-based management as a guide for the Authority's own activities, whether in its normative, interpretative, supervisory or educational competence. All agents processing personal data must adopt compliance programs in line with this movement in regulatory policy", he highlights.

Anna Luiza Berredo, partner in the TMT, Privacy & Data Protection area at Maneira Advogados. Photo: Disclosure.

LawyerMarcelo Cárgano, from the personal data regulation and protection area at Abe Giovanini Advogados, observes the pros and cons of the draft. He highlights the possibility that the defendant may present a proposal to sign a conduct adjustment agreement (TAC), but also criticizes it. "The draft brings several positive points, however, I understand that the draft presented does not meet the provisions of article 53 of the LGPD, not defining, for example, any methodology to be used to apply fines, or what would be aggravating and mitigating circumstances of the sanction", he states.

For lawyer Eber de Meira Ferreira, from the firm Peluso, Stupp e Guaritá Advogados, the entry into force of the administrative sanctions arising from the LGPD marks the full validity of the General Data Protection Law. He explains that “administrative sanctions may be applied for the mere non-compliance with the provisions of the Law in the way of processing personal data, even if there is no data leakage incident.”

In the assessment ofMárcio Chaves, partner responsible for the Digital Law area at Almeida Advogados, “we have the components for a perfect storm: daily reported incidents including ransomware; a law in force for almost a year, with several obligations already required; clients demanding their rights, legal actions; compensation; and now, the application of fines”. Chaves says that despite all these events, it is still possible to save money with adjustments now. “A good reason for companies to carry out the adjustment comes from the possibility of taking PIS/Cofins credits on expenses incurred with the implementation of the LGPD, which can mean up to 10% savings in companies' coffers”, he explains.

“The fact is that such work should already be quite mature at this point, since not only do compliance measures take time to be implemented, but the main result, namely, the incorporation of the corporate culture of data protection, takes time to reach a reasonable level”, assesses Luiza Sato, partner in the data protection, digital law and intellectual property area at ASBZ Advogados. “The expectation is not to immediately impose huge fines or other penalties, but rather to increase the awareness of companies and data holders regarding the LGPD rules, which should greatly boost compliance activities in the second half of 2021. As an example, in the scenario of mergers and acquisitions, we are already seeing many cases of requiring target companies to comply with data protection standards”, he adds.