The LGPD (Brazilian General Data Protection Law) has been a recurring topic in legal decisions, even leading to convictions. Even without any fines imposed by the National Data Protection Authority (ANPD), some companies have already been judged, and in some cases convicted, by courts throughout Brazil.
Although most cases did not result in convictions – more than 70% in 2021 and about 57% in 2022 – there were still significant convictions.
All the information cited here was taken from the Opice Blum office, referring to the reports of 2021 e 2022.
What was the average amount of fines imposed under the LGPD (Brazilian General Data Protection Law)?
- In 2021:
According to the information provided in the 2021 report, the average amounts ranged between R$ 2 and R$ 11, with this range accounting for a large percentage (80%) of the convictions. A total of 1.265 decisions were analyzed.
The monetary penalties ranged in value from R$ 600 to R$ 100.000,00.
For context, the explanation for the value of 100.000,000, far exceeding the others, stems from a public civil action seeking collective moral damages due to the installation of cameras with facial recognition technology without consent.
- In 2022:
In the last edition, 438 decisions were analyzed. The monetary penalties ranged from R$ 280 to R$ 25.948,00. The most common penalties were for amounts of R$ 3.000,00, R$ 5.000,00, and R$ 10.000,00.
The frequency of motivations was:
- Debt collection and credit protection (45%)
- Sharing/dissemination (28%)
- Leakage incidents (11%)
- Criminal (fraud, scams, etc.) – (4%)
- Unwanted contacts (without leaks) (3%)
- Consumer Data Privacy (2%)
- Financial Data Privacy (2%)
- Health Data Privacy (2%)
- Rights of Data Holders (1%)
- Privacy in the Use of Image (1%)
Remember that these values predate the regulation of Dosimetry. Now, administrative sanctions may be applied by the National Data Protection Authority. The amounts vary! Therefore, see what sanctions are foreseen for those who do not comply with the General Data Protection Law.
What are the sanctions foreseen in the General Data Protection Law?
- Warning;
- Simple fine, of up to 2% (two percent) of the company's revenue, totaling R$ 50.000.000,00 (fifty million reais), per infraction;
- Daily fine, with a total limit of R$ 50.000.000,00;
- Publication of the infraction;
- Blocking of personal data;
- Deletion of personal data;
- Partial suspension of the database operation for a maximum of 6 (six) months, extendable for an equal period, until the situation is resolved;
- Suspension of the exercise of personal data processing activities for a maximum of 6 (six) months, extendable for an equal period;
- Partial or total prohibition of engaging in related activities.
The data cited here were originally analyzed from court decisions in various courts in Brazil.
Don't risk having your company judged. Work on your company's privacy policy and, especially, on your communication with the public, regardless of their role.
Stay as far away from risks as possible, be proactive! Think about a strategy focused on your cybersecurity and understand the LGPD (Brazilian General Data Protection Law) so you don't have to deal with any kind of legal action. In this way, your clients' rights will be respected while your company preserves its image and reputation as a service provider.
To expedite your LGPD compliance journey, learn about Privacy Tools! For more information about your customers' privacy, access our site.
