Data protection authority opens consultation on calculating and applying administrative sanctions

On August 16, 2022, the Brazilian Data Protection Authority (ANPD) opened a public consultation on a draft resolution that would regulate how the ANPD calculates and applies administrative sanctions provided for in Article 52 of Brazil’s General Personal Data Protection Law (LGPD). The provisions of the draft resolution would also complement existing regulations regarding the authority’s supervision and administrative sanctioning processes, previously approved by CD/ANPD Resolution No. 1/2021. This public consultation was provided for in Article 53 of the LGPD.

Through the draft resolution, the ANPD aims to create a model for applying sanctions that serves to incentivize entities’ compliance with the LGPD, rewarding those that comply with the regulation. It also seeks to make the authority’s performance more predictable, ensuring an administrative process with adversarial proceedings, the right to full defense and the right to appeal.

Sentencing guidelines and enforcement of administrative sanctions

The draft resolution proposes specific regulation of the ANPD’s sentencing guidelines and administrative sanctions (Regulamento de Dosimetria e Aplicação de Sanções Administrativas), establishing parameters and criteria for applying these sanctions, identifying the severity of an infraction as low, medium, or high, as well as calculating the base value of pecuniary sanctions.

Sanctions would be applied in the event of the ANPD issuing a decision on an administrative proceeding. Depending on the specific characteristics of the case, sanctions could be applied gradually, at one specific moment, or cumulatively.

The regulation would also allow the ANPD to open a period for the infringing entity’s main sectoral regulatory body (with sanctioning powers) to make a statement, which the data controller must respond to when applicable.

Failure to comply with sanctions or to correct the conduct within the stipulated period may lead to more severe sanctions – without prejudice to adopting other applicable legal measures.

Changes to supervision and administrative sanctioning processes

The proposed draft resolution also seeks to revoke existing provisions within the regulation of the ANPD’s enforcement and administrative sanction processes (Regulamento do Processo de Fiscalização e do Processo Administrativo Sancionador). As such, failing to comply with an order to correct an infraction or failing to follow a compliance plan would no longer be considered aggravating factors in proceedings involving administrative sanctions.

At the same time, the draft resolution seeks to add further provisions, including:

• The failure to comply with preventive measures would be considered an aggravating factor if an administrative sanction proceeding is initiated;
• Any administrative appeal would have to be addressed to the authority that issued the decision, which would then determine if it is admissible.

Applicability to ongoing administrative processes

If approved, the draft resolution would apply to administrative proceedings in progress at the time it takes effect.

Public consultation

The draft resolution under public consultation is available on the Participa Mais Brasil platform until September 15, 2022. The ANPD has also published a Regulatory Impact Analysis Report and the votes cast by its directors on the matter. An online public hearing on the draft resolution will also take place after the consultation period. Through this process, the ANPD expects to receive opinions and suggestions from society and consider them in relation to the proposed draft resolution, before finally publishing a final version.

For further information about the ANPD’s activities and other aspects of data protection, please contact Mattos Filho’s Data Protection & Cybersecurity practice area.