Uruguay: Reform to data protection law enacted
The Official Information Center of Uruguay ('IMPO') published, on 3 November 2022, Law No. 20075 of 20 October 2022, which was enacted on 20 October 2022, following an announcement, on 11 August 2022, by the Uruguayan data protection authority ('URCDP') that a new reform was being discussed which focused on the data protection right to information. In particular, the URCDP explained that the amendments aim to make data processing more transparent, especially when algorithms are utilised for decision-making. More specifically, Article 62 of Law No. 20075/2022 introduces amendments to Article 13 of Law No. 18.331 on the Protection of Personal Data and the Habeas Data Action 2008 ('the Law'), including the obligations to inform the individual:
- at the time their data is collected from them, of the existence of international data transfers affecting the data;
- at the time their data is collected from them, of the evaluation criteria and the technological solution used, in case of automated processing of their data; and
- when personal data is not collected directly from them, within five business days, of all the details indicated under the same Article 13 of the Law.