Brazilian Data Protection Authority’s Enforcement Is Underway

Although the Brazilian Data Protection Authority (ANPD) has imposed only one fine so far, it has been publishing technical opinions—decisions on ongoing administrative procedures—which indicates that enforcement is underway.

A preliminary and recent decision on an investigation against a global social media platform focused on how the platform processes children and adolescents’ personal data. The ANPD ruled against this platform, and required that the platform take compliance measures such as:

• Revising privacy notices,
• Changing the legal status of processing for specific activities – notably, the performance of a contract would not serve as a lawful basis to deliver a personalized advertisement; therefore, changes have to be implemented on the company’s record of processing activities and any other documentation impacted therefrom – e.g., carrying out a legitimate interest assessment if applicable,
• Implementing more robust age verification measures to keep children under 13 from accessing the platform. Regarding this last requirement, the ANPD stated that although this might require that additional personal data be collected (e.g., through facial detection mechanisms or third-party vendors assessing someone’s age), the protection of children would justify the intrusiveness.

The platform is required to implement these measures within 30 business days. If it does not, it could be subject to penalties, including fines.

We will keep you posted of further ANPD enforcement developments.