We maintain a database of information about our employees, commercial partners, suppliers and customers. In Brazil, the General Data Protection Law No. 13,709/18, or LGPD, regulates the processing and limitation of personal data usage, the role of data processing agents, and created the National Data Protection Authority (Autoridade Nacional de Proteção de Dados), or ANPD. Before the LGPD, the matter was protected by the Brazilian Federal Constitution, the Brazilian Consumer Protection Code (Law No. 8,708/90), the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/14) and other Brazilian laws.
The LGPD establishes, among other things, a legal framework related to:
- Recording activities related to personal data processing, commonly referred to as data mapping. This involves surveying and organizing information on how personal data is collected, stored, and utilized;- Identifying of risks associated with these activities;- Implementing measures to mitigate these risks;- Implementing measures to mitigate these risks; and - Implementing measures to mitigate these risks.
The ANPD has autonomy to establish rules, interact with public and private sectors and oversee the processing and use of personal data (whether through complaints or by deliberation). We must observe the LGPD in implementing security measures and processing of personal data (operations involving the collection, use, access, reproduction, processing, storage, and transfer of data that identify or make identifiable a particular person).
If we are not in compliance with the LGPD, we and our subsidiaries may be subject to penalties, separately or cumulatively, of a fine of up to 2% (two percent) of our, our group or our conglomerate revenue in Brazil considering our last fiscal year, excluding taxes, but up to the global amount of R$50 million per violation. Furthermore, we may be held responsible for material, moral, individual or collective damages caused by us and be held jointly and severally liable for such damages caused by our subsidiaries due to non-compliance with the obligations established by the LGPD.
As of February 19, 2024, the ANPD had inspected and penalized four institutions: one entity from the private sector received a fine of R$14,000.00 for non-compliance with ANPD directives, while three companies from the public sector were issued warnings and corrective measures for failing to implement security requirements and improper data usage.
Failures in our legal regime of personal data protection, as well as the non-compliance with the applicable legislation, may result in high fines, disclosure of the incident to the market, elimination of personal data from our database, and even the suspension of our activities, which may negatively affect our reputation, financial results and, consequently, the value of our securities.