In brief

In the special session of 9 November 2022, the Chamber of Deputies granted the necessary approval for Congress to pass Law 27,699 by means of which the Argentine Republic ratifies the Amending Protocol with respect to the Automated Processing of Personal Data (“Convention 108+“).

To complete the ratification process, the National Executive Branch will now study the law and, if approved (most likely), it will be published in the Official Gazette.

In focus

Convention 108+ (2018) is a modern and updated version of Convention 108, which was signed in 1981 in the City of Strasbourg, France.

Argentina has been a State Party to Convention 108 since 1 June 2019, and is the 33rd country to sign Convention 108+. As part of the process to adhere to it, the bill to ratify Convention 108+ and incorporate it into our local framework was submitted to Congress. The Senate gave half sanction in 2020 and on 9 November 2022, after prior approval by the Constitutional Affairs and Foreign Affairs and Worship Commissions, the Chamber of Deputies approved it as well. Once the National Executive Branch grants its approval and the Law is published in the Official Gazette, Convention 108+ will be applicable and part of the data protection regulatory framework in Argentina. 

The importance of Argentina being a Member State to Conventions 108 and 108+, respectively, is that they are the only binding multilateral instruments on the protection of personal data as Member States decided to open the referred Conventions to countries outside the European Union. Thus, joining Convention 108+ provides legal certainty and predictability in international relationships. 

Although the ratification of Convention 108+ by Argentina strengthens our regulatory framework, it imposes a commitment to update it for the purposes of complying with the obligations assumed thereunder (since our Personal Data Protection Law No. 25,326 dates back to 2000). 

The above is especially important for Argentina to continue maintaining the status of “country with an adequate level of protection” that the European Commission conferred back in 2003 (Decision 2003/490/EC); and which has a direct and positive impact on the operations of companies, especially those that carry out cross-border transfers of personal data. 

Bills have been already filed with Congress to pass a new personal data protection law, which are aligned with international standards and benchmarking regulations such as GDPR. Likewise, on 10 November 2022, the Agency for Access to Public Information published the draft bill resulting from the public participation process initiated in September 2022.

Some of the novelties that Convention 108+ brings are:

• The definition of sensitive personal data is broadened. Genetic data, criminal records and biometric data are included.
• The security duty is expanded and imposes the obligation to notify, at least to the competent authority (as defined in Article 15), those security incidents that may seriously interfere with the fundamental rights and freedoms of data subjects. 
• Recognition of the right of data subjects not to be subject to a decision that significantly affects them and that is based solely on automated data processing, without their views being considered.
• Member States’ competent supervisory authorities must act with independence and impartiality to ensure compliance with data protection principles and to strengthen the rules on cross-border data flows. 

Undoubtedly, joining Convention 108+ represents an important step forward in terms of protecting the privacy of individuals against possible abuses in the processing of their data, as Convention 108+ is the highest and most recent international standard for safeguarding privacy.

Click here to access the Spanish version.