The Brazilian Data Protection Authority (ANPD) published, on July 6, 2023, its first punitive order against a small business based on violations of Brazilian Data Protection Law (LGPD).
The following penalties were applied:
-
warning about violation of the legal obligation to appointing a data protection officer;
-
fine of BRL 7,200.00 for violation of the provisions related to legal bases; and
-
fine of BRL 7,200.00 for violation of the obligation to submitting documents and information during supervisory processes, as provided for in Article 5 of the Inspection Regulation of the ANPD.
The full content of the reasoning of the decision and of the criteria adopted for determination of these penalties have not been disclosed by the Authority yet.
According to the order, the fine must be paid within 20 working days, as of the official notice. The company may file an appeal within 10 working days and a 25% reduction in the amount of the imposed fine may be applied in case the company expressly waives its right to appeal.
We continue to monitor this case and ANPD’s punitive activities, and we reinforce our commitment to keep you updated on any relevant developments.
