Assessing Sanctions for Violations of Personal Data Protection Provisions in Brazil and the European Union: How Much Will it Cost?

In view of the current landscape of Brazilian and European privacy laws, and given the increasing risks of data leaks and invasive attacks such as ransomware, companies must take certain measures to protect their assets and comply with privacy regulation requirements in order to mitigate risks, potential costs, lawsuits, reputational damage, and legal sanctions, among other possible consequences.

In 2018, the Brazilian Government adopted Law No. 13,709, commonly referred to as the General Data Protection Law (“LGPD”). This legislation, inspired by the European Union’s General Data Protection Regulation (“GDPR”), was enacted in 2016, imposing obligations and duties on Brazilian companies as well as foreign entities doing business in Brazil. 

Although these regulations share several similarities, there are differences in the possible sanctions a company could be subject to in Brazil and in Europe.

Both jurisdictions grant administrative authorities the power to impose warnings, fines, corrective measures, enforcement, and penalties. However, under the GDPR [1], for instance, fines may reach up to 20 million euros or 4% of the total global annual turnover from the previous fiscal year (whichever is higher) per violation, depending on the severity of the breach. Under the LGPD, fines may be up to 2% of the revenue of the company, group, or conglomerate earned in the year prior to the investigation, excluding taxes, with a maximum of R$ 50,000,000 per violation.

In addition, the LGPD establishes two types of monetary fines – the simple fine and the daily fine [2] – applicable only to private entities. The GDPR, on the other hand, establishes a single category of administrative fines, applicable to both private organizations and government bodies. 

To clarify the distinctions, we compare below the main administrative sanctions imposed by the GDPR and the LGPD:

In addition to the administrative sanctions mentioned above, individuals affected by identity theft or unauthorized access to their accounts following a data breach, for example, may, in both jurisdictions, seek civil liability from companies in court, requesting compensation.

In summary, both the LGPD in Brazil and the GDPR in Europe provide for a range of sanctions and penalties to ensure compliance with data protection laws and to defend individuals’ rights to privacy and data protection.

European countries, such as France, Germany, the United Kingdom, Italy, and Ireland, are known for their strict enforcement of data protection laws. The French authority (CNIL), for example, is renowned for imposing severe and significant sanctions, with notable cases such as the heavy fines imposed on Google and Amazon for violations of consent and cookie [4] usage. In Brazil, despite the more recent establishment and consolidation of the ANPD, there is also a strong commitment to enforcing the LGPD.

Finally, it is important to highlight the dual compliance obligation with both the LGPD and the GDPR for a company incorporated in France, for example, that has subsidiaries in Brazil.

Addressing the specific nuances of the LGPD therefore requires a tailored compliance approach, beyond a mere replication of the GDPR. Partnering with GT Lawyers’ DataTeam serves as a safeguard against potential compensation costs and sanctions mentioned above, whether at the administrative level or in legal proceedings.

[1] Unlike the LGPD, the GDPR has two levels of fines: (i) administrative fines for less serious violations, which can reach up to €10 million or 2% of global annual turnover (whichever is higher), and (ii) fines for more serious violations, which can reach up to €20 million or 4% of global annual turnover (whichever is higher). The determination of the type and amount of the fine takes into account factors such as the nature, severity, and duration of the violation, the degree of cooperation with supervisory authorities, the impact on the rights of the affected individuals, and any measures taken to mitigate the violation.

[2] The simple fine is a one-time penalty for a specific violation of the LGPD, while the daily fine is applied continuously until the authority’s determination is complied with by the company. Although the GDPR does not explicitly mention a ‘daily fine,’ it allows authorities to impose sanctions repeatedly in cases of ongoing non-compliance, effectively serving a similar role to that of a ‘daily fine.

[3] The publicity of the breach, once properly investigated and confirmed by the authority, is not one of the sanctions under the GDPR, as it is under the LGPD. For example, the Brazilian authority (ANPD) may require that the decision be published on the violating company’s website, in widely circulated newspapers, or through other relevant channels, depending on the extent needed to ensure appropriate publicity of the penalty. However, both the LGPD and the GDPR emphasize the importance of transparency and public awareness when it comes to protecting privacy and personal data rights. In this regard, both laws require that individuals be notified in the event of certain data breaches.

[4] Available at: https://www.cnil.fr/en/cookies-council-state-confirms-2020-sanction-imposed-cnil-against-amazon e https://privacyinternational.org/news-analysis/4347/cnil-fines-google-and-amazon-unlawful-use-cookies.

Nous aurons le plaisir d’avoir parmi nous le30 avril, à Montréal, plusieurs intervenants spécialisés dans l’accompagnement des entreprises canadiennes au Brésil (voir le programme détaillé)

Les places sont limitées, RSVP avant le 29 avril

Pour information additionnelle, veuillez contacter   Anne-Catherine Brunschwig

admin@gtlawyers.com.br

Le Brésil présente de nombreuses possibilités pour vos entreprises. C’est avec plaisir que nous vous invitons à ce petit déjeuner-conférence, le 30 avril 2024, au siège social de la Banque Nationale à Montréal.

Réservez cette date à votre agenda et profitez de ce moment privilégié pour échanger avec notre panel de spécialistes sur la pratique des  affaires au Brésil. Vous obtiendrez des informations stratégiques pour percer ce marché et vous aurez la chance de discuter avec d’autres entrepreneurs qui ont les mêmes objectifs que vous.

Déroulement de la Conférence:

GT LAWYERS vous invite à une conférence le 9 novembre 2022 à 16:30

Lieu: CCBC Brasil Hub

1010 Sainte-Catherine Ouest, Suite 200 – Montreal

Voir sur la carte

RSVP: admin@gtlawyers.com.br

Programme

• 16h30: Ouverture Officielle – Ambassadeur Nedilson Jorge, Consul géneral du Brésil à Montréal 
• 16h35: Se préparer à s’internationaliser, I’appui d’Investissement Québec International – Véronique Perron, conseillère – Expert Brésil 
• 16h45:Conférence “Faire des affaires au Brésil: une vision pratique des questions juridiques” – Anne-Catherine Brunschwig, associée – GT Lawyers 
• 17h25: Canada Hub au Brésil – Paulo de Castro Reis, Directeur – CCBC 
• 17h35: Cocktail de réseautage – offert par GT Lawyers
• 18h30: Fin de I’événement 

Conférencière

Anne-Catherine Brunschwig 

Associée – GT LAWYERS 

Avec l’appui de

Published in the Federal Official Gazette on September 22, 2022, Law 14,451/2022 replaces the wording of articles 1,061 and 1,076 of the Civil Code on topics related to the Resolution of Partners in Limited Liability Companies. Although the publication has already taken place, the Law takes effect 30 days after publication.

The Law was enacted with the purpose of giving more dynamism to decision-making within the scope of limited liability companies, reducing the quorums of approval of the partners provided for in the Civil Code for the deliberation and approval of certain matters, as highlighted below:

• Appointment of non-partner administrator: The wording of art. 1061 of the Civil Code, as amended, establishes that the approval of two-thirds of the partners while the capital stock is not paid in and a simple majority after the payment is made . In the current context, the unanimous approval of the partners is required, respectively, while the capital has not been paid in yet and of two thirds of partners after the capital is duly paid in.
• Amendment of articles of association, incorporation, merger or dissolution of the company or termination of its shutdown status: These matters, provided for in art. 1,076 of the Civil Code, depend, in the current scenario, on approval by ¾ (three quarters) of the partners. After Law 14.551/2022, the resolution of such matters will depend on approval by a simple majority of the partners.

The changes resulting from Law 14.451/2022 make the resolutions in the scope of limited liability companies more flexible, thus, improving the legal routine of the companies.

Therefore, as of October 22, 2022, companies that wish to make their approval quorums more flexible will be able to change their respective corporate documents

Thiago Timko Buschinelli

Isabella Lourenço Medina

On July 18th, 2022, Decree No. 11,129/2022 came into force, replacing the Decree No. 8,420/2015 which was regulating the Brazilian Anticorruption Law (Law No. 12,846/2013), which disposes about the administrative and civil liability of legal entities for the practice of corruption acts against the public administration, national or foreign.

Within the several amendments included in the new Decree, we mention below some relevant points for the business community:

The first one, refers to the Integrity Programs establishing that in addition to the implementation, the program must be monitored to ensure a strong and effective governance and ensure the maintenance of a culture of integrity. Therefore, it is not enough to implement the Program, but the company must also effectively manage and monitor it.

Secondly, the Decree emphasizes the importance of prevention as a pillar of governance, which is also reflected in several provisions, such as (i) the need to allocate resources to structure the program and a pre-approved budget from top management; and, (ii) the requirement of due diligence before hiring suppliers, service contractors, intermediary agents, brokers, consultants; sales representatives, and others; as well as, prior to entering into sponsorships and donations.

Third, the Decree provides for the sharing of legal entity data, granting more powers to governmental agencies in the preliminary investigation phase, enabling them to request tax and classified information to the legal entity, even before the beginning of the Administrative Liability Process (“PAR”), in order to investigate the alleged damaging act committed.

A fourth point to highlight is the increased weight given by the legislator to the implementation and maintenance of an integrity program within companies, as a factor that may allow for a reduction of the fine imposed in case of a violation. Under the new regulations, a company that has an effective program in place prior to the violation will be eligible for a reduction of the fine of up to 5% (five percent) of its total amount.

It is important to remember that for the calculation of the fine, the consolidation of the total gross revenues of all the companies in the economic group is taken into consideration.

In conclusion, although the implementation of an Integrity Program is not yet mandatory, through this new regulation, the Brazilian legislator creates mechanisms that can benefit companies that previously have taken this initiative, and it also increase the pressure on the companies to adopt anti-corruption prevention mechanisms.

Suellen Vargas Lopes

Anne-Catherine Brunschwig