The National Data Protection Agency (ANPD) has concluded the first phase of two monitoring processes assessing how public bodies and companies have been complying with two obligations set out in the LGPD: the formal appointment of an officer in charge of data processing and the provision of a communication channel accessible to data subjects. In all, 56 processing agents underwent the monitoring (39 public bodies and 17 private companies), with the results divided into three groups: 27 remedied what had been requested, 8 still have pending issues to correct, and 21 did not respond to the official letters sent. According to the Agency, the failure to respond, as well as noncompliance with the requests, may pave the way for further measures, including sanctions.<\/p>\n\n\n\n
The selection of the agents came from two fronts. Some of the public organizations were identified through an audit forwarded by the Federal Court of Accounts (TCU), which pointed to bodies without an appointed data protection officer. Other agents, both public and private, were added to the list based on complaints and petitions from data subjects reporting the absence of an officer or failures in the contact channels provided. In this process, the ANPD gave priority to larger controllers, at the federal and state levels, taking into account the volume of data processed and the scope of each entity’s activities.<\/p>\n\n\n\n
The phase now completed consisted of analyzing the responses submitted by the controllers that complied with the official letters. For the entities that fully met the requirements, the process has been closed. Those that presented pending issues have a deadline of ten business days, counted from notification, to bring themselves into compliance. The list of agents that did not respond, in turn, has been forwarded to the ANPD’s General Coordination for Sanctions, for review and adoption of the appropriate measures, which may include the opening of an administrative sanctioning proceeding.<\/p>\n\n\n\n
According to the ANPD, the officer plays a central role in data governance, acting as a communication channel between the controller, the data subjects, and the Agency itself; likewise, the existence of adequate communication channels is what allows data subjects to exercise their rights in a simple and effective way.<\/p>\n\n\n\n