LGPD administrative fines begin to apply

In order to enable greater security in the processing of personal data of individuals, Law 13.709/2018, named as the General Data Protection Law and popularly known by the acronym LGPD, entered into force throughout the national territory on September 18, 2020.

Since then, it is expected that small, medium and large companies have started a task force to adapt all their sectors and means of business to the rules provided for in the LGPD.

What few know is that the law was partially in force, since only the administrative fines for non-compliance with the law, provided for in Article 52, began to take effect from this Sunday, August 01, 2021.

The period of 1 (one) year for the beginning of the application of fines for infringing companies was granted by Congress in order to provide timely information for companies, at first, to understand what operations, both internal and External, would be influenced and make the necessary adjustments.

If it is known that the simple modification in the day-to-day of some sectors of the company, it is only a starting point for the company to comply with the law, but it is not enough. Compliance with LGPD needs to be a culture within the company and the knowledge of the entire body of employees, directors, service providers and even suppliers.

Fact is that more than ever, the Brazilian entrepreneur must take seriously and do everything possible to comply with the rules imposed by the LPGD, this is because the punishments provided for are strict and, depending, may cause great financial losses for the company.

The National Data Protection Authority (ANPD) will be the main body responsible for overseeing compliance with the LGPD throughout the national territory and, therefore, this will be the entity that will apply administrative fines when any irregularity is found.

The penalties vary in: administrative, such as the application of warnings, payments of high fines calculated up to 2% (two percent) of the turnover of the infringing legal entity, limited, in total, to R$ 50,000,000.00 (fifty million reais) per infraction,the publicity of the infraction committed, a measure capable of tarnishing the company’s reputation in the market, making its growth unfeasible and even the Prohibition of using certain data, a penalty that may even make it unfeasible to continue of the company.

Little is known about how the ANPD will carry out the inspection and apply the fines, but it is expected that this will occur in phases and the infractions will be measured in degrees of severity, starting with the application of warnings, with a more educational focus, so that the company knows what, how and even when it needs to adapt its operation to comply with the law and, later, in cases where the adequacy is not regulated even after receiving the necessary warning and guidelines, the application of the fine in Pecunia.

As stated, the ANPD will be the main body responsible for overseeing compliance with the LGPD, but it will not be the only one. By publicizing the rights that the law guarantees, it is expected that the holders of personal data themselves will assist in the supervision of the holders of their data and report the abuses committed not only to the ANPD, but also to the judiciary when necessary.

Thus, it is extremely important that entrepreneurs turn their attention to the General Data Protection Law and adapt their companies, because only then will they be safe and ready for when the inspections actually begin.

Marina Sampaio Costa

Lawyer, graduated in law, from the Padra Anchieta University Center (2018), enrolled in the Brazilian Bar Association, São Paulo Section (2019). Postgraduate in Business Law from Faculdade Legale, postgraduate in corporate law and Compliance from Escola Paulista de Direito (EPD), author of articles. Lawyer and manager of the advisory area at TM Associados.omit for real