News

Newsletter

Brazilian Data Protection Authority applies the second penalty for non-compliance with LGPD

Three months after imposing the first fine on a company, the Brazilian Data Protection Authority (ANPD) issued last Friday (06/10) a new sanction for non-compliance with the Brazilian General Data Protection Law (LGPD). This time, the punishment was directed at a public body and resulted in the imposition of two warnings, followed by corrective measures.

The sanctions were motivated by IAMSPE’s inappropriate conduct regarding a security incident involving personal of civil servants from the state of São Paulo and their dependents, that were accessed in an unauthorized manner by an external user.

The first warning refers to the violation of art. 48 of the LGPD, which establishes the obligation of the personal data controller to notify the ANPD and the data subjects of the incident.

IAMSPE was penalized because it did not communicate the security incident to the ANPD in time, taking around three months to do so. Similarly, the communication to data subjects was partial, lacking information such as a description of the nature of the data and the reasons for the delay in communication. For this warning, the Institute should update the notice of the incident on its website, keeping it available for at least 90 days.

The second penalty is related to art. 49 of the LGPD, which states that controllers must use systems that meet “security requirements, standards of good practice and governance and the general principles set out in the LGPD.” The infraction was classified as high since the Institute had a high volume of personal data and data of vulnerable data subjects (such as minors and the elderly) and did not implement adequate controls to guarantee the confidentiality of the data. The corrective measures related to this sanction involve the presentation of a schedule and results of the programs developed and implemented.

The ANPD’s active role in all sectors of the economy reinforces the need for all companies to handle the personal data protection matters with utmost care and responsibility.

If you wish to obtain more information on this matter, we are available at digital@kasznarleonardos.com

Back

Last related news

February 1, 2024

Betting Market and the Creation of the Secretariat of Prizes and Bets by Decree 11.907/2024

On Wednesday, January 31, 2024, Decree No. 11.907/2024 was published in the Official Gazette, creating the Secretariat of Prizes and Bets (SPA) Betting Market and the Creation of the Secretariat of Prizes and Bets by Decree 11.907/2024

Ler notícia

January 19, 2024

New Law expands Ancine’s role in the fight against piracy of audiovisual content

The enactment of Law No. 14,815 on January 16 of this year marks a significant milestone in the fight against piracy of New Law expands Ancine’s role in the fight against piracy of audiovisual content

Ler notícia

January 9, 2024

Decree regulates the free provision of cannabidiol-based medications by the Unified Health System of São Paulo

On December 26, 2023, Decree No. 68,233/2023 was published in the Official Gazette of São Paulo, regulating the free provision of cannabidiol Decree regulates the free provision of cannabidiol-based medications by the Unified Health System of São Paulo

Ler notícia
plugins premium WordPress