On December 21, 2021, the Brazilian Data Protection Authority (ANPD) updated instructions on how and when data subjects can file a complaint against a data controller for possible violation of the their rights under the General Data Protection Law (LGPD). The LGPD is Brazil’s all-encompassing data protection law similar to the European Union’s GDPR. The LGPD imposes certain requirements on data processing agents (which include controllers and processors of data) to safeguard the data privacy rights of individuals (data subjects). The ANPD has the authority to impose administrative sanctions for LGPD violations.
Under the updated instructions, the data subject must first formally contact the controller to try to get their request(s) answered or addressed. If the controller fails to resolve the issue, the data subject can petition the ANPD to intercede. The petition has to be submitted online and the data subject must provide the data controller’s or processor’s contact information and a description of the situation, and submit proof that the data subject formally made a request to the controller and it was not addressed (or was not addressed timely). In exceptional circumstances the ANPD may accept anonymous petitions and/or a self-declaration that it was not possible to provide evidence, provided the identity of the complainant is not needed to investigate the facts and the information provided can be verified.
The ANPD will address a petition specifically only if the petition could potentially affect collective and broad interests. Otherwise, the ANPD will analyze aggregated requests and use the information to launch investigations, improve regulations and implement educational actions.
By Renata Neeser via Littler