By: Leonardo Neri
Recently, there was another important step for the credibility of the LGPD. The Regulation on Dosimetry and Application of Administrative Penalties was presented, which will finally come into force after years of relaxing the regulation to make companies aware of the need to adjust their data protection policies.
What was already provided for in articles 52 and 53 of that law, will now occur directly, also, the resolution available, demonstrates guidelines on the dosimetry of the penalty, such as calculating the base value. It is important to point out that the presentation of this model was one of the gaps missing for its proper application.
Initially, the regulation deals with the ratification of the penalties already provided by law, from a warning to a complete ban on actions related to personal data.
Even so, according to the document, in view of the ANPD’s decision, sanctions will be applied when: (i) Mandatory preventive or corrective guidance forms are not met; (ii) Serious Infractions occur; (iii) There is no possibility of applying another sanction.
Therefore, after citing what will be taken into account to present the base value for sanctions, it is important to inform that the value of the fines, according to article 52 of the law under discussion, will be subject to sanctions of up to 2% of the PJ’s turnover under private law; R$50 million per violation of groups or conglomerates.
However, the resolution demonstrates the possibility of minimum values for light infractions, starting at R$1 thousand for Individuals or Legal Entities of Private Law without billing; R$3 thousand for other Legal Entities.
Medium and serious violations will be fined between R$2 thousand and R$4 thousand, for Individuals and Legal Entities without billing, and R$6 thousand and R$12 thousand for the other Legal Entities. In the meantime, it should be noted that a period of thirty (30) days from the official acknowledgement to pay the fine has been established.
As already mentioned, the prohibition of exercise related to data processing activities will occur in the following circumstances: (i) Recidivism; (ii) Use of Data for Illicit Purposes or without Legal Support; or (iii) Violator loses or does not meet basic and technical conditions of operation in an adequate manner.
Finally, the process was approved by resolution CD/ANPF nº1, aiming to carry out the ANPD’s inspection strategies.