Data processing agents that commit infractions of the rules provided in this Law are subject to the following administrative sanctions, to be applied by the national authority:
I –warning, with an indication of the time period for adopting corrective measures;
II –simple fine of up to two percent (2%) of a private legal entity’s, group or conglomerate revenues in Brazil, for the prior financial year, excluding taxes, up to a total maximum of fifty million reais (R$ 50,000,000.00) per infraction;
III –daily fine, subject to the total maximum referred to in Item II;
IV –publicizing of the infraction once it has been duly ascertained and its occurrence has been confirmed;
V –blocking of the personal data to which the infraction refers to until its regularization;
VI –deletion of the personal data to which the infraction refers to;
VII –(vetoed);
VIII –(vetoed); and
IX –(vetoed).
§1The sanctions shall be applied following an administrative procedure that will provide opportunity for a full defense, in a gradual, single or cumulative manner, in accordance with the peculiarities of the particular case and taking into consideration the following parameters and criteria:
I –the severity and the nature of the infractions and of the personal rights affected;
II –the good faith of the offender; III - the advantage realized or intended by the offender;
IV –the economic condition of the offender;
V –recidivism;
VI –the level of damage;
VII –the cooperation of the offender;
VIII –repeated and demonstrated adoption of internal mechanisms and procedures capable of minimizing the damage, for secure and proper data processing, in accordance with the provisions of Item II of §2 of Art. 48 of this Law.
IX –adoption of a good practice and governance policy;
X –the prompt adoption of corrective measures; and
XI –the proportionality between the severity of the breach and the intensity of the sanction.
§2The provisions of this article do not substitute the application of administrative, civil or criminal sanctions defined in specific legislation.
§3The provisions of Items I, IV, V, VI, VII, VIII and IX of the lead sentence of this article may be applied to public entities and bodies, without prejudice to the provisions of Laws Nos. 8,112, of December 11, 1990 (the “Legal Framework for Public Servants”), 8,429, of June 2, 1992 (the “Administrative Improbity Law”), and 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”).
§4When calculating the amount of the fine provided in Item II of the lead sentence of this article, the national authority may consider total revenues of the company or group of companies, when it does not have the amount of revenues from the business activity in which the infraction occurred, defined by the national authority, or when the amount is presented in an incomplete form or is not demonstrated unequivocally and reputably.