On February 27, 2023, the Brazilian National Data Protection Authority (“ANPD”) published the Resolution CD/ANPD No. 4, of February 24, 2023, which deals with the sanctioning action of the ANPD and regulates, among other aspects, the application, by ANPD, of sanctions for non-compliance with the Brazilian General Data Protection Law (“LGPD”).

The Regulation for Dosimetry and Application of Administrative Sanctions (the “Regulation”) aims to establish circumstances, conditions and methods for applying the sanctions provided for in the LGPD, considering, among other aspects, the damage or loss caused to data subjects as a result of non-compliance, by treatment agents, to the LGPD.

Under the terms of the Regulation, the sanctions will be applied after an administrative procedure, through a reasoned decision by the ANPD, ensuring the right to full defense, adversary proceedings and due process of law and according to the following criteria: (i) gravity and nature of the infractions and personal rights affected; (ii) good faith of the offender; (iii) advantage earned or intended by the offender; (iv) economic condition of the offender; (v) recurrence; (vi) degree of the damage; (vii) cooperation of the offender; (viii) adoption of internal mechanisms and procedures capable of minimizing damage; (ix) adoption of good practices and governance policy; (x) prompt adoption of corrective measures; and (xi) proportionality between the seriousness of the fault and the intensity of the sanction.

Thus, the Regulation, which even defines the forms and dosimetries for calculating the base value of fines, seeks to guarantee proportionality between the sanction applied by the ANPD and the seriousness of the agent's conduct, in addition to providing legal certainty and transparency to inspection processes.

It is worth mentioning that the penalties provided for by the LGPD are very strict and vary from a simple warning to a fine of up to 2% of the revenue of the legal entity or its business group in Brazil in the previous year, limited to BRL 50,000,000.00 per infraction, and even publicizing the infraction, which has the potential to cause reputational damage greater than the amount of the fine established by law.

Therefore, despite the ANPD adopting, primarily, a responsive inspection model, which prioritizes the application of guiding and preventive measures, the Regulation, which takes effect immediately, is an essential tool for the ANPD's inspection activities, as it guarantees that enforcement processes that could result in administrative sanctions are more effective and based on clear requirements.