Brazil’s ANPD fines ByteDance and Feira de Santana

Brazil’s ANPD has moved ahead with a review of its rules for calculating administrative fines while also closing two sanction cases that show a tougher enforcement posture: one against ByteDance, TikTok’s parent company, for violations in the processing of children’s and adolescents’ data, and another against the municipality of Feira de Santana, in Bahia, for the improper exposure of medical data belonging to 1,241 people.

What changed in the review of the fine rules?

The ANPD proposal updates dosing criteria, aggravating and mitigating circumstances, and also changes the calculation bases, limits and formulas used for administrative sanctions. It also provides for a review of how offenses are classified and accumulated.

According to the ANPD itself, the review adds the possibility of sanctioning new regulated agents under the Digital ECA and under decrees issued within the Internet Civil Rights framework, with their own calculation parameters. The public hearing on the matter took place on October 29, under Resolution CD/ANPD No. 4/2023.

What did the ANPD decide against ByteDance?

The ANPD fined ByteDance R$153.7 million and ordered the company to implement a compliance plan over irregularities in the processing of children’s and adolescents’ data.

The case adds to the regulator’s broader focus on digital platforms and how they process information from vulnerable groups. The sanction was reported by Valor Econômico and also appears in Mobile Time’s coverage of the fine and the compliance plan approved by the authority.

What happened in Feira de Santana?

The ANPD concluded a sanction proceeding against the municipality of Feira de Santana for the improper exposure of medical data belonging to 1,241 people in the Diário Oficial do Município.

The decision found six violations of Brazil’s LGPD, including misuse of purpose, exposure of legally protected information, lack of adequate security measures and failure to report the incident. Guairá News also reported that the authority imposed a warning and ordered the violation to be made public.

Corrective governance and security measures were also ordered. Those include appointing a data protection officer, drafting privacy and security policies, creating an incident response plan, submitting impact reports, formalizing information-sharing rules and carrying out a prior risk assessment before publishing official documents.