The Brazilian Data Protection Authority has published its first sanction under the General Data Protection Law

On July 6, 2023, the Brazilian National Data Protection Authority (ANPD) published an order imposing the first fine for breaches of the Brazilian General Data Protection Law (LGPD). The fine, totaling BRL 14,400 (around USD 3,000), was issued to a small-sized telemarketing company (Telekall Infoservice) and remains subject to appeal.

The company was investigated for personal data commercialization and for the lack of a data protection officer. According to the legal procedure prior to the sanction, the company offered a list of personal telephone numbers of voters for use in promoting electoral campaign materials in 2020. LGPD prohibits the commercialization and improper use of individuals' personal information. On top of that, the company did not have a designated professional responsible for any activities related to the use, processing, and storage of personal information. According to the LGPD, companies are required to have a Data Protection Officer responsible for ensuring the adequate protection of individuals' data and compliance with the law. ANPD stated that Telekall failed to demonstrate that it did not engage in high-risk data processing, which would be a condition to exempt the requirement of appointing a Data Protection Officer. 

The company was penalized for the following violations of LGPD: (i) the failure to appoint a Data Protection Officer, (ii) the lack of a legal basis for data processing, and (iii) non-compliance with ANPD's requests during its administrative process with respect to the company. In March 2023, ANPD released a list of the initial seven entities under investigation, consisting of six public agencies in addition to the company which has been convicted. The first fine issued by ANPD comes nearly three years after the approval of the law, which was approved in September 2020.

 

Authored by Isabel Costa Carvalho, Lizandra Baptista and Julio Alves.

 

*Hogan Lovells is registered and licensed as a foreign legal consultancy with the Brazilian Bar Association. In accordance with Brazilian Bar Association rules, Hogan Lovells does not practice Brazilian law and the discussion above regarding Brazilian laws, rules and/or regulations has been obtained from publicly-available sources and is for informational purposes only. The discussion above is limited by the nature of our practice in Brazil and is solely derived from publicly-available information. The information contained herein should not to be construed as legal advice or otherwise be a substitute for advice provided by practitioners licensed to practice Brazilian law.

Contacts
Isabel da Costa Carvalho
Partner
São Paulo

 

This website is operated by Hogan Lovells International LLP, whose registered office is at Atlantic House, Holborn Viaduct, London, EC1A 2FG. For further details of Hogan Lovells International LLP and the international legal practice that comprises Hogan Lovells International LLP, Hogan Lovells US LLP and their affiliated businesses ("Hogan Lovells"), please see our Legal Notices page. © 2024 Hogan Lovells.

Attorney advertising. Prior results do not guarantee a similar outcome.