Brazilian Data Protection Authority approves its Surveillance and Sanctioning Procedures

Data protection has been a hot topic in Brazil. Recently, the National Congress approved the Constitutional Amendment no. 17/19, which turned data protection into a fundamental right and granted the Federal Union exclusive competence to regulate about the subject. However, the Brazilian Data Protection Authority (ANPD) is the one that has been proactive.

Last Friday (October 29), the Directing Council of the Data Protection Authority issued Regulation CD/ANPD no. 1/2021. It approves ANPD’s Surveillance Process and the Administrative Sanctioning Procedure.

According to the Regulation, the surveillance activities comprehend monitoring, orientation, and prevention, demonstrating the ANPD’s intention to adopt an educative and orientational positioning. The sanctioning procedure will examine infringements to the data protection regulation in Brazil and apply the suitable penalties (according to Section 52 of the Brazilian Data Protection Regulation – Law no. 13,709/2018).

It is important to highlight that the Regulation is mostly focused on the surveillance process, ensuring data processors a more amicable approach with ANPD. The sanctioning procedure confirms the legal defense and adversarial principle, as well as sets forth similar provisions to the Brazilian Civil Procedure Code (e.g. deadlines in business days and summoning rules).

Another interesting subject brought by the Regulation is the so-called “monitoring cycle”, that aims at analyzing the compliance with the data protection rules by the processing agents and preventing uncompliant practices. The first cycle of monitoring will occur as of January 2022.

Our Digital Team is monitoring the adoption of new measures and publishing of documents by the ANPD. If you need further details, we are available at digital@kasznarleonardos.com.