On this Friday (12/20), a law amending Law 13,709/18 – the Brazilian General Data Protection Law (GDPL) – was published in the Brazilian Official Gazette. Law 13,853 modifies the original text of the GDPL with regard to administrative sanctions available in cases of violation of personal data protection rules.
The three new sanctions incorporated into the GDPL are: (i) partial suspension database operation for up to 6 (six) months, extendable for an equal period until the controller regularizes its processing activity; (ii) suspension of irregular personal data processing activity for equal period; and (iii) partial or total prohibition of irregular activities related to data processing. Among other changes, the new Law also provides that such three penalties may only be applied in case lighter penalties have already been imposed for the same controller.
The GDPL, enacted in August 2018 and to be in effect as of August 2020, regulates the processing of personal data of Brazilian citizens. Access to the Law in Portuguese in its entirety here.
