by Christian F. Rosa and Gabriel Carnaval

Last Thursday (07.06), the National Data Protection Authority (ANPD) published its first administrative sanction, marking a new stage in the oversight and enforcement of the LGPD in Brazil.

In its order, the ANPD issued a warning to the audited company, which operates in the telemarketing sector, for failing to appoint a Data Protection Officer. In addition, two fines of BRL 7.2 thousand each were imposed for the lack of a legitimate legal basis for processing personal data, according to the cases established by law, and for failing to comply with the duties relating to cooperation with the Authority’s oversight process, as set out in regulations.

Although the fines may be considered low compared to the maximum provided for in the legislation (up to BRL 50 million, under art. 52, item II), their amount took into account the small size of the sanctioned company.

With this sanctioning act, the ANPD shows that, following the recent publication of the Regulation on Dosimetry and Application of Administrative Sanctions, it is now moving to the effective enforcement of the LGPD, which is fully in force.

To avoid sanctions of this kind, companies, controllers and processors of personal data must make efforts to implement and operate a Privacy Governance Program, an internal governance system for the personal data under their management, as required by art. 50 of the LGPD.