Regarding the inspection process by the Brazilian National Data Protection Authority (ANPD), the private sector’s response has been more positive than that of the public sector, according to ANPD’s Inspection Coordinator, Ravvi Madruga. He was one of the speakers in Panel 5, discussing “Enforcement of LGPD sanctions,” along with Judge André Gustavo Corrêa de Andrade from the Court of Justice of Rio de Janeiro (TJ-RJ). The panel was moderated by Vanessa Bastos Ribeiro, Deputy Coordinator of ABPI’s Digital Law & Data Protection Committee.
Madruga clarified that the ANPD’s intention is not to punish potential violators but to bring them into a “compliant” environment. ANPD records about 30 incidents per month and has a staff of five. For comparison, the French data protection authority has a team of 200 inspectors handling an average of 2,500 incidents during the same period. In two years, the ANPD has concluded 16 cases, and currently, ten are pending, eight of which involve public bodies and only two relate to private companies.
Appellate Court Judge Andrade opened the discussion on the civil liability of data controllers under the LGPD, whether objective or subjective. He analyzed four cases of jurisprudence based on Articles 42 and 43 of the LGPD (Law 13,709/2018) and demonstrated that the issue is far from resolved. “The legislator erred by not clearly defining the nature of responsibility. However, more important than understanding how jurisprudence will position itself is creating a culture of personal data treatment. After all, we are talking about our intimacy and privacy,” he concluded.
