Argentina and Uruguay once again declared adequate countries for international data transfer
By Mariano Peruzzotti, Candela Basilotta and Andrea Sanchez Vicentini
On January 15, 2024, the European Commission (“Commission”) concluded its review of 11 existing adequacy decisions, including Argentina and Uruguay. In its report, the Commission finds that personal data transferred from the European Union to Andorra, Argentina, Canada, Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay continues to benefit from adequate data protection safeguards. Therefore, the adequacy decisions adopted for these 11 countries and territories remain in place and data can continue to flow freely to these jurisdictions.
In the cases of Argentina and Uruguay, the Commission appreciated that both countries joined the Council of Europe Convention for the protection of individuals with regard to the automatic processing of personal data and the ratification of the amending Protocol creating the modernized Convention 108+. The Commission also understood that the public authorities of both countries are subject to clear, precise and accessible rules for the access and use of personal data transferred from the European Union for purposes of public interest, including law enforcement and national security purposes.
In Argentina, the Commission also considered the independence of the Argentinian data protection supervisory authority as a consequence of the creation of the Agency for Access to Public Information through Decree No. 746/17, and the large number of binding regulations and opinions which clarify how the data protection framework is to be interpreted and applied in practice issued by said authority. Finally, the Commission recommended the approval of the Personal Data Protection Bill recently submitted to the Argentine Congress, in order to incorporate the protections developed at the sub-legislative level and strengthen the privacy framework. The Bill is currently under review by the Constitutional Affairs Committee of the House of Representatives.
With respect to Uruguay, the Commission valued the amendments to Law 18.331 on the Protection of Personal Data and the Habeas Data Action, which broadened the territorial scope of the data protection legislation, created new accountability requirements (such as impact assessments, data protection by design and by default, data breach notification and the appointment of data protection officers) and introduced additional protections for biometric data.
According to the General Data Protection Regulation, the ratification decision remains in force for 4 years and can then be reviewed, verifying the developments that may affect the decision taken. The declaration of Argentina and Uruguay as adequate countries for international data transfer underpins the digital economy in those countries and plays a key role in growth and innovation.
For further information please contact mperuzzotti@ojambf.com, cbasilotta@ojambf.com or asanchezvicentini@ojambf.com
