Legal Alert – Data protection: the National Congress ratified the accession of Argentina to the Convention 108 +

On November 9, 2022, the National Chamber of Deputies passed into law the Protocol amending the Convention for the protection of Individuals with regard to Automatic Processing of Personal Data (hereinafter, “Convention 108+”), signed on October 10, 2018, in Strasbourg, France. The outcome of the vote was 206 affirmative votes and 4 abstentions. Convention 108+ was already approved by the Senate (July 23, 2020).

Convention 108 + is a binding multilateral instrument of great importance for the protection of personal data. It aims to reinforce the protection of personal data considering the diversification, intensification and globalisation of data processing, data flow and personal autonomy. It currently has a total of 55 Member States from different regions.

The main provisions of Convention 108+ include the following:

• the obligation to notify without delay, at least to the competent supervisory authority, data breaches which may seriously interfere with the rights and fundamental freedoms of data subjects.
• the concept of “sensitive data” is extended to expressly include genetic and biometric data.
• stricter conditions are established regarding the principles of proportionality, minimisation, and lawfulness in data processing.
• incorporates, among others, the definitions of “controller” and “processor”.
• stricter requirements are placed on transparency in data processing.
• data subject’s rights are extended including, among others, the possibility to object to automated processing operations and to request information on the logic behind such processing.
• the application of the privacy by design principle is required.
• accountability becomes an integral part of the personal data protection regime.
• controllers and, where applicable, processors, shall examine the likely impact of the processing on the rights and fundamental freedoms of data subjects.
• the powers of the Supervisory Authority are extended.

The approval of Convention 108+ significantly strengthens the personal data protection framework in Argentina and it is important to maintain the recognition as an adequate country by the European Commission.

Finally, it should be noted that the entry into force of Convention 108+ in Argentina is being carried simultaneously to the process of updating Law No. 25,326 on the protection of personal data, promoted by the Access to Public Information Agency under the new direction of Beatriz de Anchorena.