Brazil fines TikTok BRL 153.7M for data breach involving teenagers

Brazil's data protection authority, the ANPD, has fined ByteDance Brasil Tecnologia BRL 153.7 million for data breaches involving the personal information of Brazilian teenagers on TikTok. The punishment was announced on Tuesday, August 25th. Alongside the hefty fine, the ANPD has ordered ByteDance Brasil to erase the personal data of adolescents aged 13 to 18 who are registered on the platform and whose legal representatives have not been appointed within 60 business days.

The company was penalized for mishandling teenagers' data and violating the principles laid out in Brazil's General Data Protection Law. The majority of the fine is composed of two BRL 63.1 million penalties and an additional BRL 27.4 million fine, totaling BRL 153.8 million. The ANPD may reduce the fine by 25% if ByteDance Brasil waives its right to contest the initial decision and pays the fine within the stipulated time frame, lowering the total to BRL 115.3 million.

The company will have five business days following the expiry of this deadline to submit a technical report to the ANPD, demonstrating compliance with the regulations. This report must include system audit logs and a formal statement signed by ByteDance Brasil's data protection officer. The ANPD may also request an independent external audit if it deems the submitted evidence insufficient to confirm the permanent deletion of the data.

Furthermore, a daily fine of BRL 137,000 will be imposed for any non-compliance with the obligations related to data deletion, submitting the technical report, or notifying third parties who received information from the affected teenagers. ByteDance Brasil has 10 business days to file an administrative appeal, or it may request a fine reduction during the same period.