Argentina: AAIP publishes draft Bill to update Personal Data Protection Act
The Argentinian data protection authority ('AAIP') published, on 10 November 2022, the draft bill to update Personal Data Protection Act, Act No. 25.326 of 2000, following a public consultation on the act during September 2022. In particular, the AAIP noted that, of the 76 articles within the draft bill, 43 articles were reviewed and modified, and four new articles were incorporated, thus the final bill has a total of 80 articles.
Simultaneously, the AAIP published, on the same date, a report on the process of the developments of the draft bill to update the Act, which outlines that updating the Act is a decisive step to raise the necessary guarantees for the protection of personal data in the information society and to establish clear rules to promote innovation and the development of the economy in Argentina. More specifically, the report elaborates that the bill incorporates the principles of pre-eminence with Article 10, which establishes that, in case of doubt about the interpretation and application of the draft bill, the most favourable to the data subject of the personal data will prevail.
Furthermore, Article 8 of the draft bill introduces data minimisation, which provides that personal data must be processed in a way that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it was collected. In this regard at the request of the AAIP, the onus is on the controller to provide justification of the need to process the data.
In addition, the draft bill includes, under Article 16, that the data controller must provide the data subject, before collection and in a concise, transparent, intelligible, and easily accessible form, with clear and simple language:
- the name or business name, address, and electronic means of the data controller;
- where appropriate, the data protection delegate; and
- where the data controllers or data processors are not established in the Argentina, the details of their representative in the national territory.
Moreover, Articles 3 and 4 of the draft bill provide clarification on the material and territorial scopes of application of the Act. Furthermore, the draft bill sets out data subject rights and introduces new definitions to the Act, including 'biometric data', 'genetic data', 'data processor', 'data controller', and 'data protection officer'. Additionally, the draft bill contains general principles regarding international transfers, noting that the burden is on the exporter to demonstrate that the international transfer is carried out in accordance to the draft bill.