Argentina: Data Protection Authority publishes Draft Bill to update Personal Data Protection Law No. 25,326

16 Sept 2022    3 minute read

In brief

In line with the process of modernizing Personal Data Protection Law No. 25,326, the Agency for Access to Public Information (DPA) presented a Draft Bill of Personal Data Protection Law ("Draft Bill").

Contents

In focus

On 12 September 2022, Resolution No. 119/2022, which includes the Draft Bill, was published in the Official Gazette.

The Draft Bill is structured in 11 chapters and includes the following novel articles, among others:

  • Definitions (Section 2). The definitions of biometric data, genetic data, data processor, data controller and data protection officer, among others, are added to the definitions set forth by the current Personal Data Protection Law. Legal entities are excluded from the definition of data subjects, and the category of sensitive personal data is expanded (it is clarified that the detailed list is an example only).
  • Territorial scope of application (Section 4). It contemplates the scenario in which the controller or processor is not established in Argentina but (i) processes data in Argentina, (ii) carries out processing activities related to the offer of goods or services to persons located in Argentina, or (ii) is located in a jurisdiction where Argentine laws apply.
  • Principle of proactive and demonstrated responsibility (Section 11). Also known as the 'accountability' principle. Basically, the controller or processor must adopt the necessary measures to ensure proper processing of personal data, which will help demonstrate the controller or processor's effective implementation of the DPA.
  • Legal basis for data processing (Section 12). Similar to the General Data Protection Regulation of the European Union, the Draft Bill foresees six legal bases, one of which is the legitimate interest of the data controller. To determine the existence of a legitimate interest, a detailed assessment must be conducted considering the context, reasonable expectations of data subjects and other specific criteria.
  • Data processing of children and adolescents (Section 18). The consent of a minor is valid if they are at least 13 years of age. If the minor is under 13 years of age, consent will be valid only if granted by the parent or legal guardian.
  • Notification of security incidents (Section 20). As a general rule, in the event of a security incident involving personal data, the data controller must notify the DPA within 48 hours of becoming aware of it.
  • Fines (Article 60). The fines that the DPA may impose on data controllers and processors range from five to one million mobile units, or from 2% up to 4% of the total annual global turnover of the previous financial year. The mobile unit is set at ARS 10,000 (approximately USD 70 at the current official exchange rate) and will be updated on an annual basis using the variation of the consumer price index (CPI). Different fines will apply to the public sector.

A term of 15 business days is granted to provide suggestions, opinions and/or comments on the Draft Bill.

To this end, a registry for proposals and opinions on the Draft Bill is established at the DPA's front desk (Av. Pres. Julio Argentino Roca 710, 3rd floor, City of Buenos Aires, Monday to Friday from 9:00 am to 4:00 pm), and online at https://www.argentina.gob.ar/aaip/consulta-publica-para-la-actualizacion-de-la-ley-de-proteccion-de-datos-personales.

In addition, informal comments can be sent to consultapublica@aaip.gob.ar. Comments will be published on the DPA website. Such comments will not be incorporated into the Draft Bill's file.

Spanish version

Contact Information
Guillermo Cervio
Partner
Buenos Aires
Read my Bio
guillermo.cervio@bakermckenzie.com
Martin Roth
Partner
Buenos Aires
Read my Bio
martin.roth@bakermckenzie.com
Valentina Biondi
Associate
Buenos Aires
valentina.biondi@bakermckenzie.com
Valentina Salas
Associate
Buenos Aires
valentina.salas@bakermckenzie.com

Copyright © 2024 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.