On the last Thursday (06/07), the General Coordination of Inspection of the Brazilian National Data Protection Authority ("ANPD") published the decision responsible for imposing the first administrative sanction for violation of the Brazilian General Data Protection Law ("LGPD").

Although we still lack elements to deepen the analysis of the case, the decision is a historic milestone for the Brazilian data protection regulatory framework and provides us with important background that can indicate how ANPD's supervisory activities will be carried out from now on.

Firstly, it is worth mentioning that the sanction was imposed on a microenterprise. Therefore, we can assume that smaller and more vulnerable companies will not be spared from ANPD's actions, and the ANPD will not focus its efforts solely on data controllers with larger and more relevant processing activities. The need to comply with the LGPD is urgent for all.

In this case, the offender was subjected to both a warning sanction and two fines, totaling the amount of BRL 14,400 (approximately USD 3,000). The warning was issued due to the lack of appointment of a Data Protection Officer. The fines were applied for violations of the article of the LGPD that sets out the hypotheses for data processing, the so-called legal bases, and for violations of the article of ANPD's Inspection Regulation that establishes the legal duties of cooperation of agents in the scope of ANPD's administrative processes.

ANPD did not disclose the case files, the calculation method used to determine the fines, or even the decision report. Thus, based on the limited information we have access to, the justifications for the sanctions are still not clear. However, the amount of the fines draws our attention, as it is significant when considering the annual revenue of a microenterprise in Brazil, as well as the fact that the offender seems to have been exempted from the criteria that define a small-scale data controller, and also because administrative violations were sanctioned.

We will continue to follow the subject and hope to bring new information soon regarding ANPD's performance in relation to inspection activities and the imposition of administrative sanctions.