Spotlight: Argentina's personal data regulation

Argentina is taking steps in the regulation of personal data with a bill in congress and a new program for transparency and data protection in the use of artificial intelligence published in recent days in the official gazette.

The bill submitted in June has generated concern on the part of the business sector and a large number of associations have raised their voices because the text does not incorporate the recommendations arising from a public consultation.

“The bill puts many companies in situations of great uncertainty, exposing them to the potential application of disproportionate fines,” Martín Lepiane, partner at the Martínez de Hoz y Rueda law firm, told BNamericas.

“By not distinguishing by size or industry, with very few exceptions, the rule will force many companies to adopt measures that may be excessive both in economic and time terms,” he added.

Internet chamber Cabase is among those trade groups that sent a letter to congress in August arguing that the bill cannot be considered a consensus project.

Lepiane said there are conflicting points in the bill related to the elimination of certain legal bases for data processing (such as unrestricted public access), the introduction of a concept such as "legitimate interest," the regulation of foreign companies and their representatives, the regulation of the figure of manager, the regulation of automated decision-making processes, and the fines stipulated in the bill.

“Sectors that [now] have clear rules will be exposed to great uncertainty as a consequence of the lack of clarity in the bill. In general terms, due to this lack of clarity, it is likely that the implementation of the standards will be uneven not only between one sector and another, but also between companies in the same sector, because each one will be forced to make its own interpretation of the provisions of the law,” Marcos Blanco, senior associate at the same law firm, told BNamericas.

Lepiane said the impact on companies that offer services that involve automated processes in their decision-making, as well as the situation of companies that process credit information, is “particularly worrying.” 

“With respect to the latter, we consider that the bill implies a step backwards rather than an advance,” he added.

CURRENT SITUATION

Argentina already has a law and numerous subsequent regulations that provided a framework for the protection of personal data. Furthermore, since the enactment of the GDPR in Europe, many companies have made efforts to adjust to those regulations.

“This has generated a positive contagion effect, which in recent years has encouraged local and regional companies to adjust their practices, at least, to Argentine regulations. However, the new bill will force many of these companies to modify their processes, and in many cases to renegotiate contracts,” Blanco said.

ARTIFICIAL INTELLIGENCE

The country's public information agency approved a program to promote analysis, regulation and capacity-building processes to accompany the development of artificial intelligence while respecting rights regarding transparency and protection of personal data.

On personal data issues, the program provides for the creation of good practice guidelines for public and private entities regarding transparency and data protection in the use of artificial intelligence, training and technical assistance, awareness campaigns and media literacy, as well as documentation on automated decision systems and publication of transparency criteria.