Special Report: Regulation on the Setting and Application of Administrative Penalties under the LGPD

A. General concepts relevant to the setting and application of administrative penalties under the LGPD

On February 27th, 2023, Resolution CD/ANPD No. 4/2023 was published in the Federal Official Gazette. The Resolution approved the Regulation on the Setting and Application of Administrative Penalties under the LGPD, in Portuguese the Regulamento de Dosimetria e Aplicação de Sanções Administrativas (“Regulation”).

The Regulation establishes guidelines for the setting and application of fines and other administrative penalties provided for in the Brazilian General Data Protection Law (“LGPD”) by the Brazilian National Data Protection Authority (“ANPD” or “Authority”).

Under article 52 of the LGPD, the ANPD can impose the following administrative penalties:

a. Warning: a penalty of an educational nature, aimed at informing the data controller or the data processor about non-compliance issues found out by the ANPD and guiding them on how to comply with standards set forth in the LGPD.

b. Fines: monetary penalty applied according to the parameters and criteria defined in the Regulation.

c. Disclosure of the infraction: the infraction shall be made public when it is of general public interest. The ANPD has the power to determine the form of disclosure (including its duration, vehicle, and content).

d. Blockage and erasure: the ANPD has the power to determine the blockage or erasure of personal data processed unlawfully.

e. Suspension of personal data processing activities: suspension of the exercise of a particular processing activity for a period of up to six months.

f. Partial or total prohibition of personal data processing activities: temporary or definitive ban on carrying out activities involving the processing of personal data.

B. Elements to be considered to determine the penalty

Article 7 of the Regulation establishes criteria and parameters that shall be used by the ANPD to determine the penalty, among which are:

• The gravity and nature of the infringement;
• The degree of damage caused;
• The economic condition of the data controller or data processor and the economic advantage obtained or intended; 
• The recidivism of the data controller or data processor; 
• The cooperation, good faith, and adoption of good practices and governance measures by the data controller or data processor; and
• The proportionality between the severity of the infringement and the extent of the penalty.
  

Minor infringements are residual in nature, where the criteria to classify them as moderate or severe are not met. Generally, considering the breadth of the criteria adopted for classifying the infringement as moderate - which includes aspects such as the possibility of the infringement causing material or moral damages to the data subjects, which, depending on the interpretation, could arguably be present in any specific case - few scenarios will result in the infringement being classified as minor.

C. Financial and economic aspects considered in determining the fine

In addition to adopting the concept of economic advantage as a criterion for classifying the severity of the infringement, the ANPD also chose to use it as a parameter for determining the amount of any monetary penalty to be imposed on the data controller or data processor. Where the economic advantage is measurable, the base amount of the fine must represent at least twice the economic advantage obtained or intended by the offender, subject to the limits of Article 52 (II) of the LGPD¹.

An additional element provided in Article 52(§1) of the LGPD is the economic condition of the data controller or data processor. The economic condition of the offender refers to the financial capacity to pay the fine. The ANPD will evaluate the offender's economic condition based on its gross revenue in the year prior to the imposition of the penalty (Article 11(II) of the Regulation). Therefore, for the purpose of defining the amount to be adopted as a parameter for calculating the maximum fine of 2% of the annual turnover, the relevant cutoff date will not be the date of the occurrence of the infringement, but rather the date the ANPD imposed the penalty.

D. Other elements to be considered in determining the fine

The ANPD will assess the extent of the damage caused by the infringement. The relevance and impact of the losses or the significance of the injury to legal interests will also be evaluated, as well as the offender's action or omission, the direct or indirect consequences of the infringement, and the risks to the data subject and the Public Administration.

When classifying the infringement as severe, moderate, or minor, the ANPD will assess the severity and nature of the conduct and the affected individuals’ rights. The degree of damage, in turn, will be assessed separately when determining the amount of the fine. The purpose is to adjust the fine according to the damages and impacts caused by the conduct of the data controller or data processor who committed the infringement.

In case of recidivism, the data controller or data processor’s prior records with respect to other infringements of the LGPD will be taken into consideration. In accordance with the Regulation, recidivism may be generic or specific: the former concerns infringements of different provisions of the LGPD, while the latter focuses on the recurrence of infringements of the same legal provision. In both cases, the ANPD will consider a period of 5 years from the acknowledgement of the res judicata in an administrative procedure for the purpose of determining a possible case of recidivism.

E. Mitigating factors in the calculation of fines

The ANPD will evaluate whether the offender acted in good faith. The cessation of the infringement will be considered as a mitigating factor in the calculation of the fine, reducing the amount of the penalty according to the time when the conduct ceased. Other mitigating factors that will be assessed for the application of penalties include:

To calculate the amount of the fine, the Regulation provides that the following proceedings must be observed:

• Determination of the base rate: Depending on the classification of the infringement, the base rate - used to calculate the base amount of the fine - can range from 0.08% to 1.5%.
• Determination of the base amount of the fine: Represented by the multiplication of the base rate by the annual turnover of the data controller or data processor, or its economic group, excluding taxes.
  
• Aggravating and mitigating factors: Starting from the base amount of the fine, the aggravating and mitigating factors present in the specific case are considered, which can increase or decrease the amount of the fine.
• Adjustment of the final amount of the fine: Finally, adjustments may be required in order to ensure the fine is within the minimum and maximum limits set forth in the Regulation. With respect to the minimum limit, the fine cannot be less than twice the economic benefit obtained or intended. On the other hand, the maximum limit of the fine is the one provided for in article 52, II of the LGPD, which can never exceed BRL 50,000,000.00 per infringement.

G. Setting aside the Regulation

Article 27 of the Regulation is a controversial one. According to such provision, in certain cases the ANPD may set aside the methodology established in the Regulation for the setting and application of the administrative penalties. This is the case where the ANPD understands that the proportionality between the severity of the infringement and the extent of the penalty is unbalanced.

Although the sole paragraph of such provision establishes that the decision to deviate from the methodology must be duly justified and not based on abstract legal values, it provides the ANPD with a significant room for maneuvering to impose penalties at levels that diverge from the Regulation, diminishing data controllers and data processors legal certainty.

H. Administrative procedure

The Regulation also establishes that penalties will be applied only after an administrative procedure is carried out, according to the terms of the Administrative Procedure Law, the LGPD, other applicable Internal Regulations, as well as the Regulation of the Inspection Process and the Sanctioning Administrative Procedure, approved by Resolution CD/ANPD No. 1, published in the Federal Official Gazette on October 29th, 2021. 

Below is a graphic representation of the steps of the sanctioning administrative procedure:

​	​The General Coordination of Inspection (Coordenação-Geral de Fiscalização or CGF) may, ex officio or upon request, carry out preliminary investigations where the suspicions that an infringement has been committed are not sufficient for the immediate initiation of a sanctioning administrative procedure. The CGF may shelve the preparatory procedure or decide to initiate a sanctioning administrative procedure.
​	​Ex officio by the CGF; Upon request from data subjects, the CGF may determine the immediate initiation of a sanctioning administrative procedure after reviewing the admissibility of the request; or The sanctioning administrative procedure may be initiated as a result of the monitoring process.
​	​After the infringement notice is issued, the offender will be summoned to present a defense within 10 business days. The ANPD may carry out investigations and add new evidence to the records regardless of the deadline for the offender to present a defense lapsing or not.
​	​Requests for producing evidence shall be reviewed by the CGF and may be denied. Where the CGF grants the request for producing expert evidence, the CGF will determine the relevant requirements for the procedural instruction and the questions to be answered by the expert. The offender may formulate additional questions and request clarifications from the forensic expert. A final brief may be presented within 10 business days before the preparation of the Instruction Report if new evidence is produced between the filing of the defense and the procedural instruction. The Instruction Report will support the first instance decision and end the instruction phase.
​	​The CFG will issue the first instance decision. The decision must apply the penalty following the parameters and criteria defined in the LGPD and the Regulation, as well as determining the deadline for compliance with the decision. Where a specific performance obligation is imposed, the decision must indicate the deadline for complying with the measures imposed and the amount of the (daily) fine.
​	​The offender may file an administrative appeal to the ANPD's Board of Directors within 10 business days of the notification of the first instance decision. Upon receipt of the appeal, the CGFmay reconsider its decision, which cannot result in an aggravation of the originally applied penalty. The appeal will be forwarded by the CGF to the Board of Directors with its analysis of the general admissibility requirements of the appeal, the granting of a suspensive effect and the merits of the appeal. The appeal will be reviewed by the Board of Directors and a final decision will be rendered.
​	​The procedure will be forwarded to the CGF for monitoring compliance with the decision. If a monetary penalty is not paid by the due date, the offender will be notified of the existence of the debt, its inclusion in the Federal Public Sector Unpaid Credit Information System (Cadin), as well as that the debt will be referred for registration in the Union's active debt. Once the decision is complied with and there are no other measures to be taken, the procedure will be shelved.
​	If new relevant facts endorsing the inadequacy of the applied sanction arise, the processes may be reviewed at the request of the offender or ex officio. The request for revision does not suspend the sanction resulting from the res judicada decision. The review cannot aggravate the previous sanction imposed in the res judicada decision.

I. Relevant changes to the Regulation

The adopted version of the Regulation underwent several changes compared to the preliminary draft the ANPD submitted for public consultation in August 2022. Although most of the modifications are of a procedural nature, some might result in relevant impacts to data controllers and data processors, such as:

1) Definition of what constitutes a "group or conglomerate of companies"

2)"Processing of personal data on a large scale" as a hypothesis for classification of a severe infringement

3) Elimination of "bad faith of the offender" as a hypothesis for classifying a severe infringement

4) Elimination of "risk to physical integrity" as a hypothesis for the classification of a severe infringement

5) Substitution of "identity theft" by "improper use of identity"

6) Limitation of exercise of right or use of service

7) Replacement of "received resources" with "earned resources" in the definition of sales revenue

J. Conclusion

The publication of the Regulation was the missing step for the ANPD to be able to apply the penalties provided for in the LGPD against data controllers or data processors that violate the law. From now on, administrative procedures before the ANPD will probably advance quickly, bringing the need for constant monitoring by organizations that may have reported security incidents or faced investigations carried out by the Authority.

With the Regulation in force, the expectation is that the ANPD will become increasingly active and that the first monetary penalties will be applied over the following months. A key point of the Regulation is the importance of the adoption of privacy programs and appropriate security measures by data controllers and data processors, considering that these elements may significantly reduce the penalties imposed by the Authority.

If your organization has not yet implemented measures to ensure compliance with the LGPD, BMA's Data Protection and Cybersecurity Team is available to support you in structuring and implementing an effective and appropriate privacy program, tailored according to the special needs of your organization's daily operations.

¹ The fine is limited to 2% of the annual turnover of legal entity, its group or conglomerate in Brazil, in the preceding financial year, excluding taxes, and cannot be higher than BRL 50,000,000.00 per infringement.