In August, Argentina's Agency of Access to Public Information, the data protection authority of the Argentina Personal Data Protection Law, initiated the process aimed at reforming the personal data protection regime. Personal Data Protection Law No. 25,326 passed in 2000 and complemented by Regulatory Decree No. 1558/2001 and several resolutions, rules and guidelines issued by the DPA. During that time, no substantial amendments were introduced to the text of the PDPL.

Meanwhile, Argentina joined Convention No. 108 for the Protection of Individuals with Regard to the Automatic Processing of Personal Data and the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+). The ratification of Convention 108+ by Congress is still pending.

The DPA held several meetings with different stakeholders such as associations related to personal data protection, privacy professionals and experts, former DPA’s directors, among others throughout August. On Aug. 30, the IAPP Buenos Aires KNet chapter hosted a privacy event where Director of the Access to Public Information Agency, Beatriz de Anchorena, presented the main guidelines of this legislative initiative.

The draft bill

On Sept. 12, 2022, DPA Resolution 119/2022 that released the draft bill was published in the Official Gazette. This resolution also formally initiated the public consultation process.

The draft bill follows the provisions of the EU General Data Protection Regulation in many aspects. It contains 11 chapters and 72 articles.

These are some of the most relevant changes proposed by the draft bill:

• Definitions: New terms have been introduced to the list of definitions such as consent, transfer, international data transfer, genetic data, biometric data, anonymization, pseudonymization, profiling, controller, processor, representative, similar to Article 27 GDPR, third parties, data protection officer, among others.
• Data subject: Unlike the PDPL, the draft bill only covers the personal data of individual excluding the information of legal entities.
• Territorial scope: Following the GDPR and other similar regulations such as the Brazil’s General Data Protection Law, the draft bill would apply to organizations outside Argentina if they offer goods or services to, or monitor the behavior, of persons in Argentina among other cases.
• Principles: Data minimization and accountability are introduced as data processing principles. The draft bill also recognizes the technology neutrality principle which implies that the provisions will apply to any processing of personal data regardless of the techniques, processes or technologies.
• Legal basis: The draft bill provides the processing of personal data will be lawful where one of the six grounds is fulfilled, including legitimate interest. Pursuant to the PDPL, the only legal basis is consent, with a limited number of exceptions to the consent rule.
• Sensitive data: Additional legal bases are introduced for the processing of sensitive personal data. The draft bill includes the criteria of enhanced liability when processing this kind of information.
• Children: The draft bill provides special protection for children and sets forth specific rules for protecting children personal data when processed in the context of information society services. Children under 13 must have their parents’ or guardian’s consent on their behalf.
• Security incidents: The draft bill imposes the obligation to notify data breaches to the DPA without undue delay and within 48 hours of becoming aware if the breach is likely to result in a risk to data subjects’ rights. Data subjects must also be communicated of the breach if this is likely to result in a high risk to his/her rights.
• Cross border data transfer: The draft bill clarifies the provisions on international data transfer which will be allowed when:
  • The third country ensures an adequate level of protection for the personal data as determined by the DPA.
  • The exporter provides appropriate safeguards on the data processing conditions (such as the case of standard contractual clauses, BCRs, or certification mechanisms).
  • A transfer fits within one of the derogations for specific situations — including consent.
• Data subject’s rights: New rights are added to the current list provided for in the PDPL (information, access, rectification, update, removal and withdrawal of consent) such as the rights to data portability, to not be subject to automated decision making (or profiling), and to object. The organization has 10 business days to respond to a data subject's request.
• Data protection impact assessment: Where the controller is considering conducting a data processing that based on the nature, scope, context and purposes may likely result in a high risk to the rights of data subjects, an assessment of the impact of the envisaged processing shall be carried out. Like the GDPR, the draft bill lists the cases where such assessment is mandatory and sets forth the minimum content that it shall contain. Prior consultation to the DPA is mandatory if the result of the DPIA reveals a high risk to data subject’s rights.
• Data protection officer: The appointment of a data protection officer is mandatory in specific situations and voluntary in the remaining cases. The draft bill describes the position, qualifications, requirements and tasks for this role. A group of undertakings may appoint a single data protection. The role can be covered by a staff member or provider.
• Representative: In line with the GDPR, a representative must be appointed by foreign controllers and processors that are covered by the provisions of the Argentine law considering the rules of territorial scope.
• National Registry: Controllers and processors that must appoint a data protection officer as well as those that have to designate a representative will need to be registered with the DPA. No further database registration will be required.
• Fines: The amount of fines was increased considerably and they will be updated annually.
• Grace period: Companies will have one year to adjust their proceedings to the new requirements of the draft bill.

Public consultation and next steps

Resolution 119/2022 also initiated the public consultation process. Any natural or legal person, public or private was allowed to submit their proposals and opinions until Oct. 11.

The DPA will now evaluate the contributions and will probably make some adjustments to the text that will be discussed with the sphere of the Federal Executive Branch for its subsequent introduction in Congress, tentatively in October 2022, according to the schedule informed by the DPA.