Proportionality in personal data use and right to avoid unsolicited communications in Peru

Authorities and lawmakers in Peru recently advanced two notable developments regarding the protection of personal data and its relationship with consumer rights.

In May, the Peruvian authority that oversees the processing of personal data, the Autoridad Nacional de Protección de Datos Personales, issued recommendations regarding certain normalized commercial practices that may involve the unintentional transmission of individuals' personal data through indirect methods — like photographing a National Identity Document during a product delivery.

The DPA emphasized that data subjects may refuse to comply with such practices and simultaneously urged companies processing personal data to seek alternative methods to fulfill the purpose, particularly in confirming the delivery of products to their recipients.

Peru's Personal Data Protection Law and the Regulation of the Personal Data Protection Law require that data processing meet the necessary standard of proportionality to achieve its purpose. In this sense, the authority stated that photographing a DNI would not be proportionate. The ANPD's recommendations contain additional information that the data subject may be unaware of disclosing and that companies may collect data without prior authorization — exposing both parties to security breaches and sanctions for unauthorized use and processing.