In 2018, the General Data Protection Law (Law No. 13,709/2018 – locally named “LGPD”) was sanctioned, regulating practices related to the processing of personal data in a general manner and no longer sparse and sectoral since which was how privacy and data protection was regulated in Brazil. On September 18, 2020, LGPD came into force, except for articles 52, 53 and 54 of LGPD, which cover administrative sanctions and have been in force since August 1, 2021, in the form of Law No. 14,010/2020. LGPD established a new legal framework to be observed in personal data processing operations and provides. Among other things, it covers the rights of personal data subjects, the legal bases applicable to the protection of personal data, the requirements for obtaining consent, the obligations and requirements relating to security incidents and leaks and data transfers, in addition to the authorization for the creation of the National Data Protection Authority in charge of drawing up guidelines and applying administrative sanctions in the event of non-compliance with LGPD. On August 26, 2020, the federal executive issued Decree No. 10,474/2020 approving the regimental structure and the flowchart of commissioned positions and roles of trust of the National Data Protection Authority (“ANPD”).
The Company collects, uses, processes, stores and manages personal data in the normal course of its business. This personal data may be processed in breach of legislation and is subject to security incidents, in particular hacking, breach, blocking, hijacking or leaks. The Company must also provide a secure environment for the processing of data holders’ data. Investment to sustain the technical and administrative conditions for information security and personal data protection at the Company will also be required, including to support its corporate governance structure for personal data protection. Furthermore, according to LGPD, the Company has a legal duty to maintain a communication channel with the holders of the personal data it processes.
LGPD also establishes that the following information must be provided to data subjects, including through privacy notices: (i) specific purpose(s) of the processing; (ii) means and duration of the processing; (iii) identification of the data controller; (iv) contact information of the data controller; (v) information regarding the sharing of personal data with third parties and the purpose; and (vi) responsibility of the processing agents involved.
Since August 2021, with the entry into force of the sanctions of LGPD, the Company and its controlled companies may be, gradually, individually or cumulative, subject to the sanctions of (i) warning, with indication of a deadline for the adoption of corrective measures, (ii) obligation to disclose the incident, (iii) partial suspension of the operation of the database to which the infraction refers for a maximum period of 6 (six) months, extendable for an equal period, (iv) suspension of the exercise of the activity of processing the personal data to which the infringement refers for a maximum period of 6 (six) months, extendable for the same period, (v) temporary blocking and/or deletion of personal data, and (vii) a fine of up to 2% (two percent) of the turnover of the company, group or conglomerate in Brazil in its last financial year, excluding taxes, up to the global amount of R$50.000,000.00 (fifty million reals) per infraction.
Regardless of the applicability of administrative sanctions, non-compliance with any of the provisions of LGPD has the following risks: (i) the filing of individual or collective lawsuits claiming compensation for damages arising from violations, based not only on LGPD, but also on the sparse and sectoral legislation on data protection still in force; and (ii) the application of the penalties provided for in the Brazilian Civil Rights Framework for the Internet, in case of a violation of its provisions, notably the security rules for the online storage of information.
In addition, the Company may be held liable for material, moral, individual or collective damages caused and be held jointly and severally liable for material, moral, individual or collective damages caused by the Company and its controlled companies, due to non-compliance with the obligations established by LGPD. Thus, any failures to protect personal data processed by the Company and/or to comply with the applicable legislation may result in high fines, disclosure of the incident to the market, deletion of personal data from the database, and even suspension of its processing activities, which may negatively affect the Company’s reputation, image and overall performance.