Intellectual Property, Privacy, New Technologies and Legal Advertising
In Argentina, we are expecting some changes and news regarding the protection of personal data in the upcoming year. The half-sanction in Congress of an important international treaty, the presentation of a new comprehensive reform bill of Laws No. 25,326 and No.° 26,951 and the resignation of the Director of the Agency of Access to Public Information (“AAPI”), the national data protection authority, bring about new perspectives as well as some uncertainties for 2021.
Firstly, on July 23, 2020, the Upper Chamber gave half-sanction to the Additional Protocol that modifies the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. This international treaty of the Council of Europe, better known as Convention 108, is the most important international convention on the protection of personal data and currently has a total of 55 Member States from different regions. The Additional Protocol that is in the process of being approved in Argentina updates the content of the treaty -whose original version dates from 1981 and was last modified in 1999- and replicates some of the changes introduced by the General Data Protection Regulation (“GDPR”) of the European Union. If Convention 108+ is finally approved, the categories of sensitive data would be explicitly expanded in Argentina, by including biometric data and genetic data, data subjects would have the right to oppose to automated data processing operations and require information on the logic underlying this kind of processing, the number of countries considered adequate by law to receive international transfers would increase and controllers would have to face an explicit obligation of accountability.
Secondly, on November 17, 2020, a new draft bill on the protection of personal data was presented in the Lower Chamber by lawmakers of the Unión Cívica Radical, an opposition party. The bill proposes a modernization of the current personal data protection framework, which brings it closer both to the GDPR and to the General Data Protection Law of Brazil. Essentially, its contents resemble those of a previous bill that was not passed, promoted by the AAPI and sent to Congress by former President Mauricio Macri in 2018. The current draft bill expands the legal bases that authorize the processing of personal data, including implied consent, substantially increases the amount of fines that the supervisory authority may impose, establishes a criterion of extraterritorial jurisdiction and incorporates whole new institutions, such as the data protection officer, the privacy impact assessment and the rights to data portability and opposition.
Thirdly, Dr. Eduardo Bertoni recently resigned his position as Director of the AAIP for personal and professional reasons. His resignation letter was accepted on December 16, 2020 through the Executive Order No. 1012/2020. Since January 1, 2021, he is no longer the Director of the AAIP. Currently, his position is vacant and the procedure to determine his replacement should be followed as established in Law No. 27,275. The President must select a candidate who will have to undergo a public hearing, in which he can be questioned by experts and citizens alike. After the hearing, the President must decide whether to continue supporting the candidate or whether to restart the selection process with a new candidate altogether. According to Article 27 of the aforementioned Law, the term to begin the selection procedure is of 30 days from the moment the vacancy occurred. The new Director of the AAIP will stay 5 years in office – with a single possibility of re-election – and will certainly lead to a change within the national data protection authority.
In summary, controllers of personal data will probably face new and more rigorous obligations during 2021 and the change of management in the AAIP may give rise to other developments, either through regulation or through the expansion of its budget.