On September 19th, the Executive introduced a bill to update the current regulatory framework on the protection of personal data . If enacted, it will revoke Law No. 26,343 on the Protection of Personal Data, Law No. 25,326 on Habeas Data and Law No. 26,951 on the “Do Not Call” National Registry. The bill is the outcome of a process launched in August 2016 by the “Justice 2020” Program of the Ministry of Justice. It is not yet known in which committees it will be addressed.

The bill incorporates two new principles of data processing in addition to those of loyalty, purpose and accuracy provided for in current legislation. On the one hand, data must be limited to what is strictly necessary for the fulfilment of the pursued purposes (principle of minimisation). On the other hand, data controller must take the necessary measures to ensure that the processing takes place in an appropriate manner (principle of proactive liability). These measures include, among others, safeguarding the security and confidentiality of data to avoid loss, misuse or unauthorised processing, as well as data protection by design and by default. Any security incident must be reported by the data controller to both the supervisory authority and the users concerned.

The bill states that the use of data requires the free and informed consent of the owner. Although it allows tacit consent, it restricts the use of the data obtained to a single purpose and as long as the owner has not objected to its use. The processing of sensitive data that affect the intimate sphere of the holder is prohibited without his/her explicit consent. Explicit consent is a sufficient condition to enable the transmission of data outside the national territory. In the case of electronic services involving the processing of personal data, the owner has the right to obtain a copy in a structured format that allows subsequent use. He/she will also be able to request that the data be transferred directly from data controller to data controller when technically possible.