In brief
The Data Protection Bill of Law submitted to Congress proposes significant amendments to the current regime and introduces mandatory provisions that are novel to Argentine legislation. For example, it includes express references to the extraterritorial scope of application and changes the traditional approach to the legal basis for the processing of personal data. In this alert, we address some of these changes and novelties. Note that the bill is still subject to amendments by both chambers of Congress.
Key takeaways
The bill proposes, among others, the following significant amendments to the current regime and introduces mandatory provisions that are novel to Argentine legislation:
1. General provisions
The bill redefines the scope of the law, limiting it exclusively to the protection of personal data of individuals. This implies that legal entities, who are also considered data subjects in the current regime, are excluded from its scope.
The bill expands the territorial scope of the law by incorporating the principle of extraterritoriality and providing that the law may apply even when those responsible for the database are located outside the national territory.
2. Processing of personal data
The bill abandons the current logic based on the prohibition of processing personal data without securing consent of data subjects (limited exceptions apply), introducing assumptions that legitimize and justify the processing (including the legitimate interest of those responsible for the database).
The bill provides that the minimum age for granting consent is 16 years. In the current regime, a minimum age is not established and the sufficient capacity of the minor must be considered in accordance with the principle of progressive autonomy of the National Civil and Commercial Code (Resolution AAIP 4/2019).
The bill also includes the duty to notify security incidents both to the enforcement authority and data subjects.
3. Cross-border transfers
Instead of a system based on the prohibition of transferring personal data to countries that do not offer adequate levels of protection (with limited exceptions), mechanisms are foreseen to carry out the cross-border flow of personal data in a secure manner.
4. Rights of data subjects
The bill incorporates new rights, such as the right to limitation, portability and opposition, as well as rights related to automated decisions and profiling.
5. Duties of those responsible for the database
The bill introduces the figure of the Data Protection Delegate, the impact assessment related to data protection, and binding regulatory mechanisms. In addition, the bill incorporates the figure of the “representative” of those responsible for databases and data processors who are not established in Argentina but are subject to the application of the law.
Likewise, the bill creates the National Registry for the Protection of Personal Data, where those responsible for the database and processors must register.
6. Data protection of credit information
The bill provides that this personal data may only be processed in accordance with the legal basis set forth therein. In addition, among other novelties, the bill introduces the duty to notify any change to the data subject’s credit situation.
7. Procedures and sanctions
The bill introduces a mobile unit for the application of fines, which is subject to the variation of the Consumer Price Index, thus substantially increasing the amounts of the penalties. It establishes a maximum of 1 million mobile units, which at the initial value of such unit represents ARS 10 billion. In addition, the bill contemplates an alternative option for applying a fine of up to 4% of the offender’s total annual global turnover in the financial year prior to that of the application of the sanction.
8. Habeas Data Action
The bill expands the standing to sue for collective actions in the Habeas Data Action.
The bill may be subject to amendments by both chambers of Congress.
We want to thank Agustin Gastaldi, who is a Paralegal at BakerMcKenzie, for his contribution to this article.
Click here to read the Spanish version.
