Data Protection Authority imposes first penalties for violation of the Brazilian General Data Protection Law
On July 6, 2023, it was published in the Official Gazette of the a decision rendered by the General Coordination of Inspection (CGF), a body of the National Data Protection Authority (ANPD), which imposed the first penalties on a data controller for violation of the provisions of the Brazilian General Data Protection Law (LGPD) and the provisions of a regulation issued by the ANPD.
The penalties were applied to the company Telekall Infoservice for violating Articles 7 (existence of a legal basis for processing) and 41 (appointment of data protection officer) of the LGPD, and Article 5 (duties of regulated agents) of the Regulation of the Inspection Procedure and Sanctioning Administrative Process within the scope of the ANPD.
In total, two penalties of a simple fine were imposed, each in the amount of R$ 7,200.00, for violations related to non-compliance with the duties of regulated agents and the lack of a legal basis for data processing, and a penalty of a warning for failure to appoint a DPO.
Although it is not yet possible to assess the rationale for the decision, considering that access to the entire records of the sanctioning administrative process has not yet been released, the decision is extremely relevant for the regulatory environment of data protection in Brazil, being a historic milestone of the beginning of repressive action by the ANPD.
The decision is also paradigmatic in that it demonstrates that data protection legislation should not be a concern only for large organizations, since the first penalties were imposed to a micro-enterprise, making it clear that enforcement with the LGPD will be carried out by ANPD regardless of the size of the data controller or data processor.
BMA's Data Privacy and Cybersecurity team will continue to monitor the evolution of the application of penalties for violations of the LGPD and is available to clarify any doubts or assist in any work related to compliance with the LGPD.
