[co-author: Paula Pagani]
On December 20, 2019, the Brazilian Congress amended the Brazilian General Data Protection Law (Law No. 13,853/2019, the “LGDP”) to include new provisions related to the so-called administrative sanctions.
In case of violations, the LGPD provides that the National Data Protection Authority (“ANPD”) must notify the data processing agents of the violation and determine a deadline for adopting remediation actions, such as deleting or blocking the personal data. The data processing agent may also be subject of a daily fine (limited to BRL 50,000,000) if the agent does not take the required measures within the deadline, and the ANDP may also impose additional fines (up to 2% of the revenues of the legal entity in its last fiscal year, limited to BRL 50,000,000 per violation) and require public disclose of the violation.
With the new amendment, after the enforcement of any of the measures set forth above, the ANPD may also impose the following:
- Partial suspension of the database’s operation—for a maximum period of six (6) months, and renewable for the same period until all activities are regularized;
- Suspension of the processing of personal data—for a maximum period of six (6) months, renewable for the same period;
- Partial or total prohibition to perform activities related to data processing.
[View source.]
