In brief
On 25 August 2022, Personal Data Protection Law No. 149 was published in the Official Gazette of Cuba. It will enter into force in February 2023.
The main purpose of the law is to guarantee the right of individuals to the protection of their personal data and to regulate the use and processing of data by public and private persons or entities.
By enacting the law, Cuba joins the list of countries with specific legislation on data protection.
In focus
The Personal Data Protection Law (“Law“) derives its foundation from (i) Article 40 (Human dignity), Article 48 (Personal and family privacy, the right to the image and voice, honor and personal identity), and Article 97 (the right of individuals to access their personal data, as well as the right to request its non-disclosure) of the Constitution of Cuba; and (ii) the impact on society of technological developments, especially in the digital environment.
The Law aims to: (i) guarantee the right to the protection of personal data; (ii) ensure due respect for personal and family privacy, and ensure protection of an individual’s image and voice, honor and personal identity; (iii) regulate the effective processing of personal data and the use of public information; and (iv) promote and foster a culture of data protection.
It must be noted that only individuals are considered as data subjects under the Law (unlike in Argentina, where legal entities are also considered as data subjects). Furthermore, the Law provides that as a general rule, the collection and processing of personal data requires consent from data subjects, which may be express or tacit (some exceptions apply, for example, with respect to the processing of sensitive data).
In all cases, data subjects must be informed of the following information: the lawful basis of processing; the manner by which data will be processed; the recipients of the data; the optional or compulsory nature of providing data; data retention; the consequences of providing inaccurate data, as well as the format by which data will be stored.
Key provisions of the Law include the processing of personal data of minors, the rights of data subjects (including the corresponding actions for the protection of personal data), and national and international transfers of data.
We will continue to monitor the practical effects of the Law as and when it takes effect.
Click here to access the Spanish version.
