On October 28, 2021, the Governing Board of the National Data Protection Agency (ANPD) issued CD/ANPD Resolution 1/2021, approving the rules of the Administrative Oversight Proceeding and Administrative Penalty Proceeding in the ambit of the ANPD (“Regulation”). The Regulation establishes the procedures and rules of the administrative proceedings for oversight of compliance and punishment of violation of the General Data Protection Law (LGPD – Law 13,709/2018) and its rules.

The Regulation establishes two types of administrative proceedings, distinguished by their purposes: the Administrative Oversight Proceeding (“PAF”), which involves monitoring, guidance and prevention; and the Administrative Penalty Proceeding (“PAS”), intended to ascertain and deter violations of data protection legislation. 

The PAF has broader purposes than the PAS and does not involve the application of sanctions or other coercive measures. This proceeding has the main objective of stimulating the development of a “data protection culture”, including incentives for self-regulation, transparency and self-composition between violators and aggrieved parties. The activities under the aegis of the PAF can be summarized as follows:

(i) Monitoring activity: intended to gather data and information relevant for supporting decisions of the ANPD, with the aim of assuring the correct functioning of the regulated environment. The monitoring activity will serve as the basis for establishing guidelines for identification of irregularities, including the power of subpoena.

(ii) Orientation activity: characterized by actions based on economicity and the use of methods and tools to promote the orientation, awareness and education of treatment agents and data subjects. The orientation measures consist of recommendations and the establishment of standards of behavior, but without the power to punish regulated agents.

(iii) Preventive activity: consists of actions based preferably on joint construction and dialogue regarding solutions and measures to guide treatment agents to full compliance or avoid or remedy situations that can cause risk of damage to data subjects and other treatment agents. Like the orientation activity, the preventive activity does not involve coercive measures, instead it employs measures to prevent disclosure of information, notices, solicitations for regularization and compliance plans.

In turn, the PAS involves procedures pertinent to enforcement of rules by the ANPD, including investigation of infractions of the rules on protection of personal data. This enforcement activity is aimed at interrupting situations of risk or damage, to assure full compliance and to punish violators, through the application of the sanctions established in Article 52 of the LGPD. 

The PAS can be commenced: (i) ex officio by the General Oversight Coordination; or (ii) in response to complaints lodged by interested parties, after the General Oversight Coordination analyzes the admissibility of the complaint, and then decides to open a penalty proceeding.

If the indications of infraction are not considered sufficient to justify commencement of a PAS, it is possible to conduct a “preparatory proceeding” with the aim of carrying out preliminary inquiries about the potential infraction. This proceeding can be conducted in secrecy, in the interest of preserving evidence. Upon conclusion, the General Oversight Coordination can shelve the case or open a PAS, without prejudice to the adoption of measures for orientation and prevention, according to the case.

The Regulation specifies the processing of the PAS, which is divided into four phases: opening, evidence collection, decision and appeal. 

The PAS is opened with the issuance of an infraction notice by the General Oversight Coordination of the ANPD, a document that must contain identification of the alleged offender(s), the conduct in question, the facts to be examined and the legal or regulatory provisions allegedly violated. The respondent is notified to present a defense, with all the evidence deemed necessary, within 10 business days.

The ANPD can take measures to produce further evidence at any stage of the proceeding, with assurance of the right of rebuttal by the respondent, including evidence produced in other administrative or judicial proceedings. After presentation of the defense, the ANPD can notify the respondent to provide clarifications or produce additional evidence. 

After the end of the period to present the defense, and irrespective of whether a defense was presented, an evidentiary report will be prepared, to support the decision to be rendered by the General Oversight Coordination regarding the facts narrated. There is no time limit for the preparation of the evidentiary report. 

After conclusion of the evidentiary report, the decision phase begins: the case file is sent to the General Oversight Coordination for the first-instance decision, which must be motivated, indicating the facts and legal grounds. The result will be a verdict, with possible application of the sanctions according to the criteria defined in the LGPD. 

If the first-instance verdict indicates guilt, the respondent will be notified to comply with the sanctions within the period determined according to the situation, or to file an administrative appeal to the Governing Board of the ANPD, within 10 business days counted from the receipt of the notice. If no appeal is filed, or the respondent fails to comply spontaneously with the decision, the case will be sent for enforcement by the competent body of the Office of the Attorney General.

The appeal against the decision of the General Oversight Coordination submitted to the Governing Board of the ANPD will start the appeal phase. But before sending the appeal to the Governing Board, the General Oversight Coordination can exercise judgment of retraction, partially or totally reforming its decision, by issuance of a substitute verdict, expressing the grounds for the change in the verdict. That decision cannot increase the sanction applied in the original verdict, and if it totally exonerates the respondent, it will be submitted to re-examination by the Governing Board.

The appeal will be distributed to one of the members of the Governing Board of the ANPD to act as the rapporteur, who can request analysis of the case or input from other bodies of the ANPD. If there is a risk of aggravation of the situation of the appellant during consideration of the appeal, the appellant will be notified to present new allegations, within 10 business days. 

The decision of the Governing Board of the ANPD regarding the appeal will be preceded by analysis of admissibility by the rapporteur, and issuance of his/her vote for granting (in full or partially) or denial of the appeal, after which the other Board members will cast their respective votes. If the sanction is upheld or enhanced, the case will be sent to the General Oversight Coordination, which will monitor compliance. 

Besides the appeal process, the Regulation also establishes a PAS review process, which can occur at any time, at the request of any interested party or ex officio, when relevant new facts or circumstances arise indicating possible inadequacy of the sanction applied.

Some other provisions of the Regulation should also be highlighted:

(i) Staying effect of appeals: The appeals to the Governing Board of the ANPD will have staying effect limited to the contested matter of the decision, reservation made for situations of grounded risk of harm of difficult or uncertain repair resulting from the enforcement of the appealed decision.

(ii) Interested third parties: The Regulation recognizes the possibility of inclusion of interested third parties in the PAS, with limited access to the documents in the case file. Such third parties can also appeal against decisions for shelving the PAS.

(iii) Joint judgment: Analogous cases where there is a risk of conflicting decisions can be grouped together for joint judgment, both in the first and second instances.

(iv) Consent decrees: The Regulation specifies the possibility of entering into an administrative consent decree (called “term to adjust conduct” – TAC), prompted by a proposal presented by the respondent in a PAS. The ANPD will issue the internal rules for negotiating TACs.

The Regulation took effect on the date CD/ANPD Resolution 1 was published, on October 29, 2021.

More information, as well as the full content of CD/ANPD Resolution 1/2021 and the Regulation, can be found at the website of the ANPD (www.gov.br/anpd).