During the past days there have been important changes in the Data Protection sector, with the incorporation of two new regulations.

a. Congress approved the law on ratification to the Amending Protocol with respect to the Automated Processing of Personal Data (the “Convention“)

The Convention was the first binding international instrument which protects the individual against abuses which may accompany the collection and processing of personal data, and which seeks to regulate at the same time the international flow of personal data.

We set out the key changes brought by the Conventions as follows:

• Prohibition of processing of "sensitive" data, it also broads the definition of sensitive data by including genetic data, criminal records and biometric data.
• Recognition of the right of data subjects not to be subject to a decision that significantly affects them and that is based solely on automated data processing, without their views being considered.
• Obligation to notify, at least to the competent authority, those security incidents that may seriously interfere with the fundamental rights and freedoms of data subjects.
• Restriction on the rights laid down in the Convention are only possible when overriding interests (e.g. State security, defense, etc.), are at stake.
• Restrictions on transborder flows of personal data to States where legal regulation does not provide equivalent protection (which is already contemplated in some Resolutions issued by the local Data Protection Authority).
• The Convention encourages local authorities to act with independence and impartiality to ensure compliance with data protection principles and to strengthen the rules on cross-border data flows.

b. Creation of a foreign entities Register of Databases to guarantee the full enjoyment of subject data’s rights

The Agency of Access to Public Information (“AAIP) has published in its website, the creation of the Register of Personal Databases for foreign entities. As a consequence of this, foreign entities that are not registered locally must appoint a representative who will be responsible for the registration of any database that include information of Argentinean residents before the AAIP. This representative will be also responsible for any modification or cancellation of such database.

As a reminder, any personal database must be registered with the Agency of Access to Public Information. Registration requires the following information:

• the name and domicile of the person in charge of that database;
• the characteristics and purpose of the database;
• the nature of the personal data contained in each file;
• the method of collecting and updating the data;
• the recipients to whom such data may be transmitted;
• the manner in which the registered information can be interrelated;
• security measures;
• data retention period; and
• means for individuals to access, correct and update their data.

c. Finally, The Data Protection Authority Resolution No. 244/2022 has set the amounts of the administrative fines that may apply when a company is sanctioned more than once for the same conduct, as follows:

• Moderate — up to AR$3,000,000 (US$; 17,647 at the current exchange)
• Severe — up to AR$10,000,000 (US$; 58,823 at the current exchange)
• Very severe — up to AR$15,000,000 (US$; 88,235 at the current exchange)