Spotlight: Cybersecurity regulation in Latin America

Latin American governments need to take a tougher and more professional stance on cybercrime, according to experts. 

“While we did not foresee this in the early development of the internet, today governments must grapple with this reality. This will require greater collaboration of governments and global businesses, and importantly, long-term strategies to educate the public on why cybercrime is important to them and their families, and how they can reduce the risk,” Cyrus Vance, president of Baker McKenzie's North American cybersecurity unit told BNamericas. 

Brazil and Mexico are regional data protection leaders, as they also suffer a rising number of cyberattacks, Carolina Pardo, partner at Baker McKenzie, told BNamericas. “Other jurisdictions are not implementing specific measures, although there are some good starting points in the guidelines on data security in Colombia and a bill in Chile,” she added. 

Pardo said cybersecurity may trigger obligations to disclose data breaches which in many, but not all countries must be reported to authorities and those whose data has been affected. 

Brazil’s data protection is modeled along the EU’s GDPR standards and includes an obligation to map data and create a security plan in line with data sensitivity. Pardo said countries like Argentina will follow shortly. 

“Understanding how to react, who should report and to whom, what to do within the first 72 hours after the cyberattack is critical to develop a plan that should be preceded by a good strategy,” she said.

Vance also said stronger laws and more effective enforcement are necessary. “But enforcement will never have the same impact to reduce crime as smart prevention strategies at the government, business and public levels,” he said. 

Pardo said awareness and accountability are “key elements that we need to implement in the region to reduce the impact of cyberthreats.” 

She added, “understanding that this is a long-term project, here to stay and grow, is the only mindset that will help companies reduce the impact of cyberthreats to their business.”

Threats

Vance said attacks will rise globally, specifically so-called ransomware-as-a-service attacks in Latin America. “In North America ransomware will remain the greatest threat and, in Latin America, internal corporate email schemes, which occur at a greater percentage than in North America.”

According to a global IDC survey, 54% of respondents have suffered ransomware attacks, while only 48% of companies had backup and disaster recovery policies.

Government institutions in Costa Rica suffered attacks this year, causing losses of US$10mn in imports and exports, while sensitive data from Peru’s intelligence service was stolen, according to IDC.