Argentina: Regulation on international data transfers responds to “worldwide business needs”

24 November 2016

The Argentinian data protection authority (‘PDP’) published, on 18 November 2016, Regulation 60 – E/2016 on international transfers of personal data (‘the Regulation’), which introduces two model contracts for international data transfers to countries that do not provide adequate levels of protection. The Regulation also requires notification to the PDP, within 30 days, when contracts other than those provided in the Regulation are used for an international data transfer.

Florencia Rosati and Ludmila Petrinelli, Partner and Associate at Estudio Beccar Varela respectively, told DataGuidance, “In our opinion, the Regulation clearly reflects the aim of the PDP to adapt Argentinean legislation to worldwide business needs. We believe that the PDP intends to periodically update the list of countries [which it considers to have adequate levels of data protection] in order to include those countries that have appropriate data protection regulations, a capable supervisory authority and an independent judicial system.”

The Regulation complements Section 12 of Argentina’s Data Protection Law 2000 No. 25.326 (‘the Law’), which prohibits transfers to countries that do not provide adequate levels of protection. The use of the model contracts introduced by the Regulation will now allow such transfers. Similarly to the EU, one model contract must be used for transfers by data controllers to data controllers, while the other must be used for transfers to data processors rendering services.

The PDP has been going through an internal audit aiming to apply, in a more efficient way, all the data protection regulations.

Rosati and Petrinelli stated, “We believe that one of the reasons this Regulation has been issued now is that after the presidential election in December 2015, a new Director for the PDP was appointed. The new Director, Eduardo Bertoni, has broad experience in freedom of speech and human rights on the internet, and we believe that he has introduced/supported this initiative. Furthermore, the PDP has been going through an internal audit aiming to apply, in a more efficient way, all the data protection regulations. Thus, this internal audit may also have led to the issuance of the Regulation, since it was a pending matter that had to be addressed sooner or later.”

Though Argentina is one of only two countries in Latin America, together with Uruguay, to have been granted adequacy by the European Commission, the PDP is currently considering amendments to further strengthen the Law.

Rosati and Petrinelli concluded, “[The amendments are] being discussed in several official and unofficial events. What can be inferred from such events is that the new Law will very possibly be aligned with the new General Data Protection Regulation, mainly considering that the Law resembles former European data protection norms. Notwithstanding this, we cannot foresee when such amendments may be officially filed and discussed in Congress.”

Rachael Nelson-Daley | Junior Privacy Analyst