Brazil’s General Personal Data Protection Law May Bring Sanctions Regarding Suspension and Prohibition of Activities

On September 24, the National Congress Plenary overturned presidential vetoes regarding Provisional Measure Bill of Law No. 869/18, with the main change concerning the applicable administrative sanctions. Thus, the following sanctions provided for in the Law are again included in the text of such Law:

  1. partial suspension of the operation of the database to which the infraction refers;
  2. suspension of the exercise of the activity of processing of personal data to which the infraction refers; and
  3. partial or total prohibition of the exercise of activities related to data processing.

It should be noted that for the first two sanctions, namely the suspension of the operation of the database and the exercise of the activity of processing personal data, a suspension is defined as lasting 6 months, until the infringement is regularized.

However, the National Data Protection Authority (“ANPD”) should first apply the other sanctions such as fines, publicity of the infraction, blocking and deletion of the personal data to which the infringement relates to, before proceeding with the suspension and prohibition penalties described, which are considered to be more serious.

Other aspect vetoed by the President, in relation to the possibility of reviewing automated decisions by humans, is pending examination by the National Congress.

Our Data Privacy and Cybersecurity team is available to provide further information on this matter.