The members of Venezuela’s National Constituent Assembly (ANC), headed by Leg. Diosdado Cabello (Partido Socialista Unido de Venezuela – ruling party) are preparing a draft bill on cybersecurity. The measure seeks to strengthen cybersecurity and data protection policies in both the public and private sectors. The government thus aims to guarantee the integrity of national technological systems in the face of cyber attacks. Although there is still no exact date for the finalization of the draft and its introduction to the ANC, it is expected to take place in the coming weeks. Once the measure is introduced, it is highly likely to be passed by the ANC since the ruling party is unanimous.

The main provisions of the draft are:

• Competent agency. The initiative creates the National Cyberspace Center (CNC). Its main function is to develop and implement policies related to the safeguarding, confidentiality and availability of data, among other competencies. The CNC also establishes mandatory security standards for all public and private institutions handling sensitive data.

• Data collection. The National Cyberspace Center may obtain, use and disclose any type of protected data in public and private entities without the consent of the affected party, only when the CNC considers that national defense and integrity are under threat.

• Data protection. Public and private institutions that safeguard personal data through technological means must guarantee its integral protection. To achieve this, they must:
  • Comply with the cybersecurity standards and good practices established by the National Cyberspace Center.
  • Report to the Venezuelan authorities any type of irregular situation that could endanger national cybersecurity.
  • Avoid manipulation by unauthorized personnel.

• Sanctions. Data owners, service providers and users who fail to comply with any provision will be penalized with fines ranging from USD 5,414 to USD 21,656.

• National Cyberspace System. This system encompasses all public and private initiatives aimed at safeguarding reliability, integrity, availability and responsibility in the use of cyberspace elements.