Newsletter
11 de October de 2023
Brazilian Data Protection Authority applies the second penalty for non-compliance with LGPD
Three months after imposing the first fine on a company, the Brazilian Data Protection Authority (ANPD) issued last Friday (06/10) a new sanction for non-compliance with the Brazilian General Data Protection Law (LGPD). This time, the punishment was directed at a public body and resulted in the imposition of two warnings, followed by corrective measures.
The sanctions were motivated by IAMSPE’s inappropriate conduct regarding a security incident involving personal of civil servants from the state of São Paulo and their dependents, that were accessed in an unauthorized manner by an external user.
The first warning refers to the violation of art. 48 of the LGPD, which establishes the obligation of the personal data controller to notify the ANPD and the data subjects of the incident.
IAMSPE was penalized because it did not communicate the security incident to the ANPD in time, taking around three months to do so. Similarly, the communication to data subjects was partial, lacking information such as a description of the nature of the data and the reasons for the delay in communication. For this warning, the Institute should update the notice of the incident on its website, keeping it available for at least 90 days.
The second penalty is related to art. 49 of the LGPD, which states that controllers must use systems that meet “security requirements, standards of good practice and governance and the general principles set out in the LGPD.” The infraction was classified as high since the Institute had a high volume of personal data and data of vulnerable data subjects (such as minors and the elderly) and did not implement adequate controls to guarantee the confidentiality of the data. The corrective measures related to this sanction involve the presentation of a schedule and results of the programs developed and implemented.
The ANPD’s active role in all sectors of the economy reinforces the need for all companies to handle the personal data protection matters with utmost care and responsibility.
If you wish to obtain more information on this matter, we are available at digital@kasznarleonardos.com.
Last related news
1 de July de 2025
New PPH Cycle Opens for Third Quarter of 2025 – Telecommunication Applications Excluded
In accordance with Ordinance 03/2025, published by the BPTO on March 25, 2025, a new limit of 800 Patent Prosecution Highway (PPH) … New PPH Cycle Opens for Third Quarter of 2025 – Telecommunication Applications Excluded
1 de July de 2025
Brazil’s Supreme Court Partially Strikes Down Internet Law Provision, Imposes Stricter Duty of Care on Online Platforms
On Thursday, June 26, the Brazilian Supreme Federal Court (STF) issued a landmark ruling, partially invalidating Article 19 of the Brazilian Internet … Brazil’s Supreme Court Partially Strikes Down Internet Law Provision, Imposes Stricter Duty of Care on Online Platforms
24 de June de 2025
Software License Compliance: A Constitutional and Strategic Right
In Brazil, the holder of intellectual property rights is entitled not only to economically exploit their work, but also to monitor how … Software License Compliance: A Constitutional and Strategic Right