- Deadline for re-registration of databases until October 31st, 2019 -
I - Personal Data Protection Law No. 25,326.
The Personal Data Protection Law No. 25,326 (hereinafter the "Law") is in force since year 2000, and regulates the processing and protection of personal data included in files, records, or other means of storage, both public and private (hereinafter "Database").
Within the scope of the Law, we would like to highlight some labor issues that we believe are important to consider.
Database Registration: The Law creates the obligation to register all Databases before the Argentine Data Protection Authority (hereinafter the "DPA"). For example, Databases containing personal information of employees.
Information to the employee: Employers must inform their employees, when collecting their personal data, in a prior, express and clear communication, the way the data will be processed, and the purposes for which this information is collected.
Employee’s Consent: The Law also requires that, in order to process that data, the responsible of the Data Base should get the prior, express and informed consent from the employees. Although there are exceptions to this principle that would apply in labor matters related to the processing of the data necessary to comply with tax and registration obligations, we believe that the employee's consent would be necessary when transferring personal data to other private entities, such as subsidiaries, companies of the same group or parent companies (unless this measure was to comply with legal obligations).
International transfer of data: Certain limitations and special regulations apply for international transfer of data, which must be analyzed on a case-by-case basis, considering, among other things, the country receiving the data.
Development of policies on the processing of data: The Law foresees the possibility of implementing policies (codes of conduct) that establish standards for processing personal data, reflecting the principles of the Law. This would help to avoid contingencies, as well as possible fines from the DPA.
II - Deadline for Re-registration. Executive Order No. 132/2018.
Executive Order No. 132/2018 (hereinafter, the "Executive Order") of the DPA, published in the Official Gazette on October 22, 2018, establishes a new system for the obligation to register private and public Databases. The registration process is free and must be done through the Distance Procedures Platform ("DPP").
Through the DPP, companies must proceed to replace the Databases already registered, and re-register all their Databases with the DPA. The deadline to complete the re-registration of private Databases will expire on October 31st, 2019.
On the other hand, those who did not register their Databases, should register them now.
The companies should register all their Databases that contain information of any type referred to individuals or legal entities, including, therefore, the Databases of suppliers, personnel, etc. It is important to clarify that the content is not registered, only the existence of the Database.
III - Conclusions.
It is important for employers to analyze the impact of these rules set by the Law regarding the registration and management of data of their employees. To this effect, please feel free to contact us in order to:
- Register the Databases, or help you through this process, in order to comply with the deadline mentioned above.
- Prepare the communication to the employees, informing that their personal data will be collected only to comply with legal obligations, and that the data will be processed with due confidentiality.
- Prepare the document by which the employees give their consent to process their data, when the data is not necessary to comply with legal obligations, or when transferring data that is not necessary for the fulfillment of these legal obligations.
- Develop data privacy policies, in accordance with legal regulations.
- Analyze alternatives for international transfers of data.