Communication of security incidents in the General Data Protection Law

the definition of the deadline through Regulatory Impact Analysis as an indispensable instrument for the enforcement of the National Data Protection Authority

Abstract

When security incidents involving data protected by the General Data Protection Law occur, the regulations require that there be timely communication to the National Data Protection Authority and, if there is not, sanctions could be applied, under the terms of art. 52 of the LGPD. However, there is no deadline previously established by legal or regulatory instruments. Thus, the research problem of this article can be expressed by the following question: are the administrative sanctions applied by the National Data Protection Authority for failure to notify the person in charge of the occurrence of security incidents within the period suggested by the special authority valid? Two objectives are established to answer this question: 1) to verify the ANPD's regulatory competence from the perspective of the Laws on Agencies, the Economic Freedom Law (LLE), as well as Decree No. 10.411/2020; and 2) to identify the nature of the regulatory problem and demonstrate the need for prior preparation of a Regulatory Impact Assessment (RIA) to apply sanctions in the factual situation under analysis. It is concluded that the administrative sanctions applied by the National Data Protection Authority for failure to notify the person in charge of the occurrence of security incidents without prior stipulation of an appropriate deadline through RIA are not valid, under penalty of violation of the constitutional principle of legality, art. 5 of the LLE and art. 6 of the Law