Argentina Alters Rules on Cross-Border Data Transfers
Jurisdictions with Adequate Levels of Data Protection
The Argentine Personal Data Protection Authority (the Agency) issued Disposition No. 60 - E/2016 (the Disposition) by means of which it has approved certain specific contractual clauses to be included under cross-border data transfer agreements for the assignment and provision of data processing services. The goal of the Disposition is to ensure an adequate level of protection of the personal data for cross-border transfers to jurisdictions that do not provide an adequate level of data protection.
In addition, the Disposition established that the cross-border transfer of personal data to countries that do not offer an adequate level of data protection executed by means of contracts that do not include the contractual provisions approved, shall request approval of the Agency within a maximum term of 30 (thirty) days counted as from execution of the same.
In this regard, the Disposition included the list of jurisdictions that provide an adequate level of data protection. Those jurisdictions are: (i) European Union and members of the European Economic Area, (ii) Swiss Confederation, (iii) Guernsey, (iv) Jersey, (v) Isle of Man, (vi) Faroe Islands, (vii) Canada (only for private sector), Andorra (viii), (ix) New Zealand, (x) Uruguay and (xi) Israel. This list will be reviewed periodically by the Agency.