Data processing agents that commit infractions of the rules provided in this Law are subject to the following administrative sanctions, to be applied by the national authority:
I – warning, with an indication of the time period for adopting corrective measures;
II – simple fine of up to two percent (2%) of a private legal entity’s, group or conglomerate revenues in Brazil, for the prior financial year, excluding taxes, up to a total maximum of fifty million reais (R$ 50,000,000.00) per infraction;
III – daily fine, subject to the total maximum referred to in Item II;
IV – publicising of the infraction once it has been duly ascertained and its occurrence has been confirmed;
V – blocking of the personal data to which the infraction refers to until its regularisation;
VI – deletion of the personal data to which the infraction refers to;
VIII – (vetoed); and IX – (vetoed).
§1 The sanctions shall be applied following an administrative procedure that will provide opportunity for a full defence, in a gradual, single or cumulative manner, in accordance with the peculiarities of the particular case and taking into consideration the following parameters and criteria:
I – the severity and the nature of the infractions and of the personal rights affected;
II – the good faith of the offender;
III - the advantage realised or intended by the offender; IV – the economic condition of the offender;
VI – the level of damage;
VII – the cooperation of the offender;
VIII – repeated and demonstrated adoption of internal mechanisms and procedures capable of minimising the damage, for secure and proper data processing, in accordance with the provisions of Item II of §2 of Art. 48 of this Law.
IX – adoption of a good practice and governance policy; X – the prompt adoption of corrective measures; and
XI – the proportionality between the severity of the breach and the intensity of the sanction.
§2 The provisions of this article do not substitute the application of administrative, civil or criminal sanctions defined in specific legislation.
§3 The provisions of Items I, IV, V, VI, VII, VIII and IX of the lead sentence of this article may be applied to public entities and bodies, without prejudice to the provisions of Laws Nos. 8,112, of December 11, 1990 (the “Legal Framework for Public Servants”), 8,429, of June 2, 1992 (the “Administrative Improbity Law”), and 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”).
§4 When calculating the amount of the fine provided in Item II of the lead sentence of this article, the national authority may consider total revenues of the company or group of companies, when it does not have the amount of revenues from the business activity in which the infraction occurred, defined by the national authority, or when the amount is presented in an incomplete form or is not demonstrated unequivocally and reputably.