Introduction

In remarks to the Assembly in its plenary session, Dennis Marín, National Assemblyman, noted that the draft law seeks to guarantee the exercise of the right to the protection of personal data as well as to regulate and develop principles, obligations, and mechanisms to facilitate its protection. If enacted, the draft law would establish guaranteed privacy rights and protection for Ecuadorian citizens who previously relied on the principle of habeas data under the Constitution of the Republic of Ecuador as well as other limited sector-specific laws relating to telecommunications, financial services, and electronic commerce. Mario Alejandro Flor, Partner at Flor & Hurtado, discusses its significance noting that, "for the first time in history, Ecuador will have a specific legal regulation to govern every matter related to the protection of personal data. Until now, there have only been general legal provisions regarding public data. The bill approved by the Assembly creates not only a regulatory framework, but also a complete administrative structure to manage everything related to this matter."

Scope of the draft law

Marín went on to add that the draft law establishes safeguards including obligations to guarantee fair and responsible data processing which empowers individuals to have more control over their data. Moreover, the unanimously approved draft law provides for an extraterritorial scope and draws many similarities from European standards. Similarly, Flor continues, "in general terms, most of the [General Data Protection Regulation (Regulation (EU) 2016/679)] ('GDPR') standards are included in the bill, which provides certainty with respect to the considerations, requirements and conditions to be met for the collection, storage and transfer of personal data. The bill also creates the Superintendence of Data Protection, that will be entitled to enforce the rules and to issue sanctioning procedures, in case of administrative infringements."

In relation to the enforcement regime, Marín outlined that the draft law establishes the Superintendence of Data Protection, which will be an independent entity whose function will be to enforce the draft law, impose fines for those that violate it, and maintain a national registry of data protection, the latter replacing the partial function of the National Directorate of the Public Data Registry. In addition, the draft law provides for the issuance of major and minor sanctions which may be imposed on both data controllers and processors. Fines range from 3% to 17% of annual turnovers and mitigation will be dependent on factors including the intention, the gravity of the violation, as well as the reoccurrence of the violations. Lastly, enforcement action will take place following administrative procedures before the newly established Superintendence of Data Protection.

Moving forward

The draft law has been long awaited in Ecuador following its introduction in September 2019 in the Assembly and has strong legislative support, with Marín urging legislators to pass the draft law, stating that it would place Ecuador in a modern framework.

Flor further explained, "the [draft law] was proposed by the President of the Republic, so now that the procedure is pending for his approval, it is most likely that it will not receive any modification. However, since we are just days away from the change of congressmen (14 May 2021), it will probably be the new Assembly that would officially enact it."

Conclusion

If enacted this year the draft law would introduce significant changes for organisations operating in the region. With strong legislative support, Ecuador could become the next Latin American country to enact comprehensive data protection legislation.

Edidiong Udoh, Privacy Analyst
[email protected]

Comments provided by:
Mario Alejandro Flor, Partner
[email protected]
Flor & Hurtado