Editor's note: The IAPP is policy neutral. We publish contributed opinion and analysis pieces to enable our members to hear a broad spectrum of views in our domains.
Authorities and lawmakers in Peru recently progressed two notable developments regarding the protection of personal data and its relationship with consumer rights.
In May, the Peruvian authority that oversees the processing of personal data, the Autoridad Nacional de Protección de Datos Personales, issued recommendations regarding certain normalized commercial practices that may involve the unintentional transmission of individuals' personal data through indirect methods — like photographing a National Identity Document during a product delivery.
The DPA emphasized that data subjects may refuse to comply with such practices and simultaneously urged companies processing personal data to seek alternative methods to fulfill the purpose, particularly in confirming the delivery of products to their recipients.
Peru's Personal Data Protection Law and the Regulation of the Personal Data Protection Law require that data processing meet the necessary standard of proportionality to achieve its purpose. In this sense, the authority stated that photographing a DNI would not be proportionate. The ANPD's recommendations contain additional information that the data subject may be unaware of disclosing and that companies may collect data without prior authorization — exposing both parties to security breaches and sanctions for unauthorized use and processing.
The ANPD previously ruled on this matter in a decision involving the well-known national clothing store Renzo Costa, stating that requesting to photograph a customer's DNI during product delivery violated the principles of proportionality and purpose. The ANPD said this is because the act involved collecting additional personal data the user had not voluntarily provided during the purchase process — such as marital status, photo, location code, and issue and expiration date of the DNI — which are not necessary for executing the sales contract. The authority concluded the company could not rely on the exception for personal data use necessary for fulfilling a contractual relationship.
On another front, the Congress of the Republic of Peru in May passed Law No. 32323, which amends articles of Peru's Consumer Protection Code concerning telemarketing communications — via calls or any other means — in an effort to combat so-called spam contacts.
Within the context of offering goods and services, the PDPL explicitly addresses the processing of personal data for advertising purposes. One key issue surrounding the interplay of the two laws is the so-called first contact with the data subject. While the PDPL allows this first contact to be made using personal data obtained from publicly accessible sources without prior authorization — though only once — this appears to conflict with the recent publication of Law No. 32323. The new law shifts the rule from allowing such contact unless the consumer expressly refused to an express prohibition unless the consumer, on their own initiative, requests to be contacted.
The issue lies in the fact that standard commercial practice involves first contact through phone calls and, even more concerning, third-party companies. This could pose risks not only to personal data users — who are also consumers — but to the companies benefiting from such advertising calls, exposing them to possible sanctions by both the data protection and consumer protection authorities.
The Directorate General for the Protection of Personal Data previously issued an advisory opinion titled "Consultation on first contact and the sending of information within the framework of supervisory actions," referencing the new law. While the law was not yet approved at the time of the opinion, the directorate general concluded that its approval would prevent the use of personal data — even if lawfully obtained — for initiating a first contact to request consent. This would directly conflict with Article 26 of the PDPL.
Although several experts have already identified this legal contradiction, the ANPD has yet to offer an official position. It is expected that a reconciliatory approach can be found to allow for the normative application of both laws, either through an official interpretation or legislative amendment.
Carlos Farfan is an associate at BARLAW — Barrera & Asociados S. Civil de R.L., specializing in intellectual property and data protection regulation.
