New guidelines of best practices for the application of Law N° 25,326
The Agency of Access to Public Information (“AAIP”) has approved guiding principles of best practices for the application of the Argentine Data Protection Act N° 25,326 by means of Resolution 4/2019.
According to the AAIP, it was necessary to establish these principles for the correct interpretation and implementation of the data protection regulations, in a way every citizen may access them, so as to strengthen the exercise of the rights the law protects. In this sense, the AAIP has covered the following matters: (i) data collection through video surveillance systems; (ii) automated data processing; (iii) data dissociation; (iv) biometric data; and (v) data subject´s consent, including the consent of children and adolescents.
Accordingly, the recommendations are the following:
(i) Right of access to personal data collected by video surveillance systems
In the event the data subject requires the access to his/her personal data, the following should be considered:
a) The data subject must prove his/her identity through his/her ID. In addition, the data subject must inform an approximate date and time in which his/her image could have been captured and any other information necessary for the identification.
b) The data controller must provide the data subject his/her personal data in a clear way, explaining date and time where the images were collected, the purpose, eventual transfers and/or the data´s destination and if the database has been duly registered in the National Database Registry.
c) If the data subject funds correctly the reasons for the access and collection to his/her personal data, the data controller must provide him/her the image, under the data subject´s cost. If the image allows the identification of third parties, the data controller must apply data dissociation techniques to avoid the identification.
d) The data controller must inform the data subject that, in case he/she is not satisfied with the response given, he/she will be able to submit a claim in the National Data Protection Office.
(ii) Automated data processing
Regarding this matter, every time the data controller takes decisions based on an automated data processing system, that affects the data subject in a negative way, the data subject has the right to request the data controller an explanation in relation with the logic of the decision.
(iii) Data dissociation
A person will not be considered as determinable when the proceeding for his/her correct identification requires the application of disproportionate measures.
(iv) Biometric data
The AAIP defines biometric data as “personal data collected through specific technical processing, related to physic, physiological or behavioral characteristics of a person, which permit or confirm his/her unique identification”. In this way, the AAIP establishes that biometric data is considered sensitive data.
Once the data subject provides his/her consent on his/her personal data, the data controller must prove the data subject´s identification and confirm that effectively he/she is who provided the consent, through authentification mechanisms.
Regarding personal data transfers between public organisms, data subject´s consent will not be required when: (i) the transferor has collected the personal data in the exercise of its duties; (ii) the transferee uses the personal data for the purposes under its competence; and (iii) the personal data involved is adequate and not excessive.
Finally, the AAIP establishes that, when processing personal data of children and adolescents, it must be considered that: (i) minors may consent on their own personal data while taking into account his/her psychophysical characteristics, aptitudes and development, in the view of sections 26 and 639 of the Civil and Commercial Code; and (ii) the holder of the minor´s parental responsibility may consent the processing of the minor´s personal data. In this case, the data controller must ensure that consent was actually granted by the holder of parental responsibility.
For further information on this topic please contact Pablo A. Palazzi