BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
1.2 Regulators The regulation model, in Brazil, is called “univer - sal”, which means that there is a single regula - tion for all activities, for all segments and for all agents. The regulator model reflects this option, called “concentrated”, in which an agent has the competence to regulate the protection of per - sonal data and, to a certain extent, the privacy of individuals. From time to time it is said that the Brazilian Judiciary would also have a regulatory role, as it can act to stop conducts that attack privacy and data protection. But this is debatable, insofar as the Judiciary basically depends on provocation to act, while the traditional regulator can act on its own initiative, even without provocation. Under the General Data Protection Law, the Bra - zilian regulator is the National Data Protection Authority (ANPD), an agent that recently gained the status of a federal agency. In general terms, the ANPD is responsible for ensuring, implementing and supervising compli - ance with the LGPD and other rules on personal data protection, and thereby protecting the fun - damental rights of freedom and privacy and the free development of the personality of the natu - ral person. The role of this regulator is broad and goes beyond inspecting and applying sanctions for violations of the LGPD. In addition, it also has normative, interpretative and deliberative func - tions, with an extensive instrumental arsenal to ensure legal certainty to relationships involving the processing of personal data and to the vari - ous agents. 1.3 Enforcement Proceedings and Fines The protection of privacy and the protection of personal data are strongly associated, and there - fore generally the regulator’s action on issues related to the protection of personal data has
effects on privacy, and vice versa. This means that regulatory action regarding a legal breach of personal data almost always benefits individu - als’ privacy and privacy protection as well. As a rule, the ANPD, the Brazilian regulator, can act on its own initiative, if and when any event – announced, disclosed or discovered – puts the privacy of individuals at risk or represents a vio - lation of the terms of the protection legislation. But it can also act on the external initiative, of a person whose data was improperly accessed, for example. The person interested in provoking the ANPD’s action can file a “petition”, that is, a request in which they inform that they were unable to exer - cise their rights as a data subject before the con - troller. But presenting this “petition” requires that the data subject has first addressed the control - ler, in a formal and proven manner. Another possibility is to submit a “complaint” to the ANPD, that is, a communication of an alleged violation of Brazilian personal data pro - tection legislation. But this “complaint” has peculiarities, such as that it does not relate, in general, to a specific situation of a certain holder of personal data. Once the regulator begins to act, an adminis - trative proceeding can be opened, so that the facts and circumstances related to the reported or reported event can be ascertained, guar - anteeing all those involved a full defence and adversarial proceedings. In cases like this, the regulator expresses itself at the end, deciding to archive or, depending on the situation, to apply a penalty, which can range from a warning to the payment of a fine of 2% of the controller’s revenue, limited to BRL50 million per infraction.
41
CHAMBERS.COM
Powered by FlippingBook