Estadão publishes article by Anna Berredo on ANPD inspection regulations

Estadão published an article written by Dr. Anna Luiza Berredo, partner in the TMT, Privacy & Data Protection area at Maneira Advogados, which deals with the Regulation of the Inspection Process of the National Data Protection Authority (ANPD).

The regulation of the inspection process and the responsive action of the ANPD

Anna Luiza Pires and Albuquerque de Berredo*

November 1, 2021

Continuing the work of developing the normative framework that regulates the provisions of the General Data Protection Law, the Board of Directors of the ANPD (National Data Protection Authority) approved the Inspection Process Regulation, which in a very coherent way brought the logic of the responsive line of action proposed by the ANPD, with the adoption of measures proportional to the risk encountered and the attitude of the processing agents.

Regarding the application of administrative sanctions, it proved to be quite reasonable, which leads us to understand that the ANPD's actions will be much more focused on topics of great relevance that pose greater risks to holders of personal data, and that its supervision will be more active on processing agents that have a large number of complaints for non-compliance with the LGPD, all in accordance with the Monitoring Cycle and Map of Priority Topics.

We also highlight that the ANPD manages, in a very effective way, to bring in this Regulation a more harmonious and encouraging path to promote the promotion of the culture of privacy and the fulfillment by all processing agents of their obligations, placing as premises for the inspection process, the following observances, which we list below:

I) alignment with strategic planning, with instruments for monitoring data processing activities and with the National Policy for the Protection of Personal Data and Privacy;

II) prioritization of action based on evidence and regulatory risks, with focus and orientation towards results;

III) integrated and coordinated action with public administration bodies and entities;

IV) acting in a responsive manner, with the adoption of measures proportional to the identified risk and the stance of the regulated agents;

V) encouraging the promotion of a culture of personal data protection;

VI) provision of transparency, feedback and self-regulation mechanisms;

VII) encouraging responsibility and accountability by processing agents;

VIII) encouraging direct conciliation between the parties and prioritizing the resolution of the problem and the repair of damages by the controller, observing the principles and rights of the holder provided for in the LGPD;

IX) requirement for minimum intervention in the imposition of administrative constraints on the processing of personal data;

X) carrying out supervisory activities that best suit the ANPD’s competencies.

And as had already been foreseen in the proposal for the draft Resolution placed in Public Consultation, monitoring activities will be fundamental and will guide the ANPD in its supervisory and, ultimately, sanctioning activities. However, in reference to the ANPD's supervisory activities, it is worth remembering that, in any situation, the application of a repressive measure must always comply with the rules of the sanctioning administrative process, as per art. 37 et seq. of the Regulation, as well as observing the law that deals with administrative processes at the federal level (Law no. 9784/99).

Finally, it is important to remember that it will still be necessary for the ANPD to prepare the sanctions dosimetry regulation, a fundamental regulation to complement this Resolution and provide due legal security to agents and the National Authority.

*Anna Luiza Pires and Albuquerque de Berredo, partner in the TMT, Privacy & Data Protection practice at Maneira Advogados

https://politica.estadao.com.br/blogs/fausto-macedo/o-regulamento-do-processo-de-fiscalizacao-e-a-atuacao-responsiva-da-anpd/