Draft bill 326.

Summary.

The draft bill seeks to amend and add provisions to Law 81 of 2019 on personal data protection. It proposes revising Article 36 to authorize the National Authority for Transparency and Access to Information (Autoridad Nacional de Transparencia y Acceso a la Información), through the directorate responsible for this area, to sanction a natural or legal person responsible for processing personal data and a database custodian when an investigation into a complaint or report establishes a violation of the data subject’s rights. Decisions of that directorate could be challenged through a request for reconsideration before the directorate and an appeal to the Authority’s director general as the second instance. The grounds for either challenge would have to be submitted within 5 days, counted from the next business day after notification.

The proposed Article 36 also provides that regulatory bodies apply the sanctions under Law 81 of 2019 on a supplementary basis to complaints concerning data processing governed by special laws when those laws do not expressly prescribe sanctions for the violations committed. The Authority would set the amounts according to the seriousness of the violations, from 1,000 balboas (B/.1,000.00) to 100,000 balboas (B/.100,000.00), and regulate the procedure. Monetary sanctions it imposes that remain unpaid after the allotted period would be referred for collection to the Directorate General of Revenue (Dirección General de Ingresos) of the Ministry of Economy and Finance (Ministerio de Economía y Finanzas).

The amendment to Article 41 classifies the intentional collection of personal data, failure to comply with rules on sensitive data, and continued processing after an order from the Authority to suspend it as very serious violations. It includes storage or international transfer contrary to the Law, repeated serious violations, and improper processing of a minor’s personal data. The amendment to Article 42 provides that sanctions imposed on persons responsible for databases and other parties covered by the Law and its regulations be determined according to the seriousness of the violation and the offender’s financial capacity, using criteria of proportionality and deterrent effect.

The new Article 43-A assigns the Authority responsibility for maintaining a public register that would record only final administrative sanctions for serious or very serious violations. Each entry would contain the offender’s name or corporate name, the type of violation, the sanction, and the date of the final decision. The information would be public for a maximum of 3 years from the date the sanction becomes final and would then be removed automatically. The register could not include other personal data or affect rights beyond those provided for in the Law; due process and the data subject’s rights would be guaranteed. The draft bill restates the specified amendments and addition and provides that it would take effect upon promulgation in the Official Gazette. Its provisions concern the National Authority for Transparency and Access to Information, the Directorate General of Revenue, the Ministry of Economy and Finance, regulatory bodies, persons responsible for processing, and database custodians.