Heavier sanctions to the Brazilian General Data Protection Law
On last Friday (12/20), the Law 13,853/19 was published in the Brazilian Official Gazette, amending the Brazilian General Data Protection Law (13.709/18 - “LGPD”) to extend the set of administrative sanctions to be applied to violations of the rules governing the protection of personal data.
The 3 new penalties have been incorporated into items X, XI and XII of the article 52 of the LGPD, now in force with the following wording:
Article 52. Data processing agents, due to violations of the rules provided for in this Law, are subject to the following administrative sanctions applicable by the national authority:
I - warning, indicating the deadline for the adoption of corrective measures;
II - simple fine of up to 2% (two per cent) of the revenues of the legal entity of private law, group or conglomerate in Brazil in its last year, excluding taxes, limited in total to R $ 50,000,000.00 (fifty million reais) for infringement;
III - daily fine, observing the total limit referred to in item II;
IV - publicizing the infraction after duly ascertained and confirmed its occurrence;
V - block the personal data to which the infringement refers until its regularization;
VI - deletion of the personal data to which the infringement refers;
VII - (Vetoed);
VIII - (Vetoed);
IX - (Vetoed).
X - Partial suspension of the operation of the database for up to 6 (six) months, extendable for the same period, until the regularization of the treatment activity by the controller (Included by Law No. 13,853 of 2019)
XI - Suspension of the exercise of the activity of processing personal data for the same period; and (Included by Law No. 13,853 of 2019)
XII - Partial or total prohibition of the exercise of activities related to data processing (Included by Law No. 13.853, of 2019)
It is important to note that, according to §1 of such article, the foreseen sanctions will only be applied in the course of an administrative procedure in which the investigative parties will have the duly opportunity for a broad defense (following the due process of law principle).
The resolution of another imbroglio is now awaited: the vote on Bill No. 5,762/2019 (“PL 5,762”) proposing the amendment of the LGPD to extend the date of its entry into force to 15 August 2022, imposing a postponement of two (2) years from the period originally provided for by law.
Bill 5,762 was presented to the House of Representatives by Deputy Carlos Bezerra of MDB/MT Party on October 30, 2019, that is, after the LGPD was already promulgated by President Jair Bolsonaro. The proposal - which could further delay the effective development of the data protection culture in Brazil - awaits the rapporteur's opinion in the Committee on Constitution and Justice and Citizenship (CCJC).