Brazil

Besides administrative investigations by the Brazilian Internet Steering Committee (CGI.br), the following judicial entities may take judicial actions:
• Police Departments Specializing in Digital Crimes;
• State Public Prosecutor Offices;
• Federal Prosecutor Office;
All of which are entitled with investigation rights, and can request protective and coercive measures from the judiciary.
As regards penalties, the Brazilian Data Protection Legislation sets the following fines in case of breaches:
“Article 52. The data processing agents, in connection with any infractions of the rules established in this Law, shall be subject to the following administrative penalties applicable by the supervisory authority:
I – warning, with indication of a term for adoption of corrective measures;
II – simple fine of up to two percent (2%) of the sales revenue of the legal entity of private law, group or conglomerate in Brazil in its last fiscal year, excluding taxes, limited, in the aggregate, to fifty million Reais (R$50,000,000.00) per infraction;
III – daily fine, with due regard for the total limit referred to in item II;
IV – disclosure of the infraction after it has been duly investigated and its occurrence has been confirmed;
V – blockage of the personal data to which the infraction relates, until regularization thereof;
VI – elimination of the personal data to which the infraction relates”