By Leonardo Neri

The General Data Protection Law “LGPD” was approved in 2018 and only came into force in 2020, at which point companies began to pay attention and look for the best way to store personal data, including in digital media.

The aforementioned Law provides for administrative sanctions for agents who violate the applied rules, which are provided for in articles 52 and 53 of Law 13,709/2018, however the National Data Protection Authority (“ANPD”) only regulated the Regulation on Dosimetry and Application of Administrative Sanctions in February 2023.

Many companies began to receive complaints about possible violations of the Law, however the analysis of the processes remained stagnant until the criteria for applying pecuniary and non-pecuniary sanctions by the ANPD were determined.

In a recent major milestone, the first fine was applied for non-compliance with the LGPD provisions. The company was Telekall Infoservice, a telephony company headquartered in Vila Velha-ES.

The company's complaint consists of the disclosure of voters' WhatsApp contacts for electoral campaign purposes. ANPD stated that "The facts reported were related to the 2020 municipal election in Ubatuba (SP). ANPD found that the reported processing of personal data was occurring without legal support. It also found that there was no evidence of the company's appointment of a person responsible for processing personal data."

It is of great importance that the punishability has been applied, so that companies feel pressured to comply with legal determinations, as the practice of coercive acts will give rise to the foreseen punishments.

The application of this fine is of national relevance, and now everyone will be aware that the infraction generates a fine. It is essential that companies are careful and zealous with the processing of data, and now they know that they may face a very high fine, being applied in up to 2% (two percent) of the
company's turnover, and limited in total to R$50,000,000.00 (fifty million reais), per violation.

Thus, the company Telekall Infoservice will always be remembered for being the first company to pay the fine applied by ANPD in Brazil, and will serve as an example for future companies to avoid handling personal data carelessly or leaking it.

For more information on the topic, as well as possible consequences with fines applied by ANPD and the next steps that can be taken with appeals and the like, contact the partner responsible for the data protection team, Leonardo Neri.