For experts, definition of fines by ANPD puts data protection in question

Dr. Matheus Puppe, partner in the TMT, Privacy & Data Protection area at Maneira Advogados, was interviewed by the portal TeleSíntese to talk about ANPD regulations for defining fines related to the application of the General Data Protection Law by companies.

FOR EXPERTS, DEFINITION OF FINES BY ANPD PLACES DATA PROTECTION IN CHECK

AUGUST 16, 2022

Autarchy placed the Dosimetry Regulation and Application of Administrative Sanctions in public consultation. Punishments can be retroactive.

Lawyers working in processes involving the General Data Protection Law (LGPD) analyzed the public consultation on the Dosimetry Regulation and Application of Administrative Sanctionsby the National Data Protection Authority (ANPD), started this morning. For experts, the measure represents a step towards effective enforcement of the standard.

The document provides for the application of a warning, a simple or daily fine, in addition to the determination of publicity, blocking or deletion of the data to which the infraction refers (find out more below).

Márcio Chaves, partner in the Digital Law area at Almeida Advogados, explains that sanctions can be retroactive.

“We will have a new race towards the maturity of the ‘privacy’ issue for the whole country, and it will be the moment of truth for the LGPD, causing the bill to reach those who violated the LGPD since 2021, being able to be zeroed for those who strictly followed all the obligations established by law, reduced for those who failed to comply with some of its demands, or very high for those who did little or nothing”, summarizes Chaves.

The expert also highlights that the fine is just one of the many consequences of non-compliance with the LGPD, “many of which can even financially outweigh the impacts caused to those who violate their obligations, as is the case with individual and collective compensation actions, loss of existing and new contracts, partial or total stoppage of operations and even the immeasurable impact on reputation.”

DATA PROTECTION IN PRACTICE

Matheus Puppe, partner in the TMT, Privacy & Data Protection area at Maneira Advogados, compares the LGPD to the anti-corruption law to exemplify the impacts of defining sanctions.

“Many companies still ignore the need for Compliance with the LGPD, and will only make efforts when applying fines and sanctions, and defining the dosimetry of the penalty is one of the most important steps”, said Puppe.

The lawyer expects “more robust sanctions”, considering that data protection is a constitutional right. “We come from a history of abuses by companies, which tend to be restrained by the appropriate balance of cost-effectiveness of the law”, says Puppe.

For Antonielle Freitas, DPO (Data Protection Officer) at Viseu Advogados, the expectation is “moderation in the dosimetry of penalties”.

“The Authority has been adopting a responsive approach, taking great account of the behavior of the regulated, especially at this time of implementation of the data protection culture in Brazil”, stated Freitas.

For the expert, the definition of sanctions “will bring legal certainty, as it will avoid possible disproportionate penalties and form specialized administrative jurisprudence that can support decisions in other spheres”.

DRAFT

According to the draft, the definition of the sanction will take into account parameters such as: the severity and nature of the infractions, the good faith of the offender, the advantage obtained or intended by the accused, as well as their economic condition.
According to the text, infractions can be classified as: minor; average; or serious. Being serious when:

• the offender obtains or intends to obtain an economic advantage as a result of the offense committed;
• the offense involves a risk to the life or physical integrity of data subjects;
• the offense involves the processing of sensitive data or personal data of children and adolescents and the elderly;
• the offender carries out processing of personal data without the support of one of the legal hypotheses provided for in the LGPD;
• o offender takes advantage of the weakness or ignorance of the holder, taking into account his age, health, knowledge or social condition;
• the offender carries out treatment with illicit or abusive discriminatory effects;
• the offender's bad faith or the systematic adoption of irregular practices and/o
• constitutes an obstruction to the inspection activity is verified.

The simple fine will be up to 2% of the revenue of the private legal entity, group or conglomerate in Brazil in its last fiscal year, excluding taxes, limited, in total, to R$50 million per infraction.

The value will be increased by 10% in case of specific recurrence (up to a limit of 40%); 5% for generic recidivism (up to a limit of 20%); 20% for each guidance or preventive measure not complied with in the process (up to a limit of 80%); and 30% for each corrective measure not complied with, up to a limit of 90%.

The full text of the proposed application of ANPD sanctions can be accessed here. Contributions will be made on the website Participa mais Brasil.

https://www.telesintese.com.br/para-especialistas-definicao-de-multas-pela-anpd-coloca-protecao-de-dados-em-xeque/