New database register for foreign entities

In November 2022, Argentina’s data protection authority, the Agency of Access to Public Information (AAIP), created on its website a register of data controllers for foreign entities that process the personal data of Argentine residents—the Register of Personal Databases. Consequently, foreign entities not registered locally must appoint a representative who will be responsible to the AAIP for the registration of any database that includes information of Argentinean residents. This representative will be also responsible for any modifications or cancellation of such databases.

As a reminder, all personal databases must be registered with the AAIP, especially, those that process data of Argentine employees. Registration requires the following information:

• The name and domicile of the person in charge of that database
• The characteristics and purpose of the database
• The nature of the personal data contained in each file
• The method of collecting and updating the data
• The recipients to whom such data may be transmitted
• The manner in which the registered information can be interrelated
• Security measures
• The data retention period
• The means for individuals to access, correct and update their data.

Consequently, foreign companies are obliged to appoint a local representative with a Tax ID who will be responsible to the AAIP for registration of all databases that process employee data.

Employees in Argentina have the same right of access, rectification, cancellation or opposition of their personal data (ARCO rights) as any data subject. Once such request has been submitted, the employer has 10 calendar days, unless the request is for deletion or rectification of personal data, in which case, the timeframe is five calendar days.

From an employment law perspective, employers must protect employees’ personal data privacy and only use the collected data for employment-related purposes. It is advisable to inform the employees what information is being collected and the purpose of the collection.

Congress approves law on ratification to the Amending Protocol with respect to the Automated Processing of Personal Data (Convention)

The Convention widens the definition of sensitive data by including genetic data, criminal records and biometric data.

As a reminder, biometric data, health/medical information, sexual orientation, religious affiliation, union membership, etc. are considered sensitive data; its treatment is restricted, and strict security measures apply.

Furthermore, unless mandated by law, employers may not collect sensitive data from employees. Section 73 of the Employment Contract Act (ECA) forbids employers from “conducting any survey, investigation or enquiry into employees’ political, religious, union, cultural or sexual preferences” when hiring an employee or while employed.

Employers cannot use employees’ personal information as a basis of discrimination. Argentina’s anti-discrimination law, Law No. 23,592, forbids discrimination on the grounds of gender, race, nationality, religion, political or union affiliation, age, social condition, economic position or physical characteristics.