New Book about Privacy in Lat Am.

 The new book "Privacy Guide for Latin America" is now available online in the IAPP - International Association of Privacy Professionals. This is the English version of the original version published two years ago by IAPP in Spanish language (first "libro" 📖 of IAPP in Spanish language!!) and also available online.

Congratulations to the contributors -all IAPP members and old friends- Juanita Acosta from Dentons Cardenas & Cardenas; Jorge Allende from Allende & García Abogados ; Martín Pesce Cutri from FERRERE ; Marcela Ejnisman from TozziniFreire Advogados ; Rosa Maria Franco Velázquez from Axkati Legal, S.C.; Pablo A. Palazzi from Allende & Brea; Paulina Silva from BITLAW; Cecilia Abente Stewart from Abente Stewart - Abogados; Leon Weinstok from BLP & Carolina Herrera from Dentons Cardenas & Cardenas.

The book contains a detailed analysis of the privacy and data protection regulations in some countries of the Latin American region: Argentina 🇦🇷 , Brazil, 🇧🇷 Chile 🇨🇱 , Colombia 🇨🇴 , Costa Rica 🇨🇷 , Mexico , Paraguay 🇵🇾 , Peru 🇵🇪 and Uruguay 🇺🇾 .

The new book covers the legal and constitutional bases for the regulation and processing of personal data, exploring topics such as consent, notification, and security and confidentiality obligations, DPO, PIAs, among others. This book is aimed at privacy professionals throughout Latin America who wish to improve their knowledge of local rules and regulations.

Thanks to IAPP - International Association of Privacy Professionals for helping spread the knowled about lat am data protection law.

Spoiler: we are working in updating the Spanish version 📚 covering the newly enacted ⚖ laws in the region. Stay tuned! 📺

Link to the ebook at the IAPP - International Association of Privacy Professionals online store.

Linkedin post

https://www.linkedin.com/feed/update/urn:li:activity:7224874870432575488/

CorteIDH reconoce el derecho autónomo a la autodeterminación informativa en America Latina - caso Cajar v. Colombia

El caso examinado ante la Corte Interamericana de Derechos Humanos (Corte IDH) implica a los miembros de la Corporación Colectivo de Abogados "José Alvear Restrepo" (CAJAR) de Colombia, quienes se han destacado por su defensa de los derechos humanos, en particular de víctimas de violaciones perpetradas por el Estado y grupos paramilitares. Este caso es significativo debido a las medidas de intimidación y vigilancia que los miembros del CAJAR enfrentaron por parte del Estado, lo que pone en evidencia problemas más profundos de violaciones sistemáticas de los derechos humanos dentro de Colombia.

Legislative predictions for Latin America & ARgentina 2024 (IAPP)

 Argentina

By Pablo Andres Palazzi

Argentina and other countries in the region, including Chile and Colombia, are discussing bills to amend and update data protection laws. Discussions are expected to take place across the region in 2024 and in the international fora as well.

On 30 June, 2023, Argentina's executive branch sent the proposed Personal Data Protection Bill to the National Congress for consideration. Drafted by Argentina's data protection authority, the Agencia de Acceso a la Información Pública, the bill seeks to amend the current Personal Data Protection Act.

The PDPB is based on international and regional standards, recommendations and principles, including the EU General Data Protection Regulation, Convention 108+, the Standards for Personal Data Protection for Ibero-American States, and other Latin American countries' regulations on personal data protection and privacy. While the bill was drafted in open consultation with academia, international experts, non-governmental organizations, companies and several government agencies, it has faced some objections and debate will take place in the National Congress in 2024.

The bill introduces definitions, principles and rights often seen in modern data privacy legislation, including privacy by design and by default, privacy impact assessments, accountability obligations, the obligation to appoint a data protection officer and legal representative for foreign companies, extraterritoriality provisions, data breach notifications, detailed regulation of international transfers of personal data, and portability rules. There are also specific regulations for credit reporting, automated decision-making and marketing, and rules for habeas data actions. The bill also grants the AAIP new powers, including the ability to halt personal data processing or activities that may affect users' privacy.

The PDPB introduces a new fine system based on units — a unit is 10,000 pesos — the value of which will be updated by the AAIP annually. If approved, the bill allows the AAIP to sanction companies five to 1 million units, or 2 to 4% of the company's global annual turnover. This has faced criticism since the use of global annual turnover may affect global companies and increase fines. An Argentine company with branches in Mexico, Brazil and Colombia could be fined based on regional global income, for example.

Other areas of concern include the bill's set age of 16 years old for children's consent and a provision stating the local representative of foreign companies can be liable in case the company it represents does not answer a DPA request.

Argentina was the first Latin American country to have an adequacy determination from the European Commission and it appears this bill seeks to preserve this status as most of its provisions follow EU GDPR standards.

Once approved, the PDPB would be effective six months after publication in the Official Gazette. However, the new fines would be applicable immediately upon publication of the law.