Today’s edition of the Federal Official Gazette published a decision by the Brazilian National Data Protection Authority (“ANPD” or “Brazilian DPA”), imposing sanctions for non-compliance with the General Data Protection Law (“LGPD”) on yet another public entity, the Ministry of Health.
In this case, the ANPD found that the entity violated two provisions of the LGPD and issued two warning sanctions. We highlight that, as the Ministry of Health is a public entity acting as a data controller, fines could not be imposed by the Brazilian DPA.
The first warning was due to the appointment of the Data Protection Officer only after the beginning of the administrative sanctioning procedure against the Ministry of Health, contrary to the requirements of the LGPD. The second warning was motivated by the lack of submission of two Data Protection Impact Assessments (“DPIA”) requested by the ANPD.
In addition to the warnings, the Brazilian DPA ordered the Ministry of Health to submit the two pending DPIAs within 10 business days or to provide a timeline for their preparation, which must not exceed a total period of 180 days.
Our team is at your disposal for further clarifications and to assist with complying with LGPD and ANPD regulatory requirements.
Gustavo Flausino Coelho – gustavo@bastilhocoelho.com.br
Fernando Naegele – fernando@bastilhocoelho.com.br