Protection of personal data

According to Law N° 29733, Law on the Protection of Personal Data, personal data means all information about a natural person that identifies or makes said person identifiable through means that can be reasonably used.

The personal data holder is any natural person to whom personal data correspond, whereas the personal data bank holder is any natural or legal person which determines the purpose and content of the personal data bank, the processing of said data, as well as the security measures.

For example, a company is holder of the personal data bank of its employees and clients.

The processing of personal data means any operation or technical procedure, automated or not, which allows collecting, recording, organizing, storing, preserving, elaborating, modifying, extracting, consulting, using, blocking, deleting, communicating by transference or by diffusion or any other way of processing that enables the access, correlation or interconnection of personal data.

Any natural or legal person which performs the processing of personal data is subject to Law N° 29733 and its regulations, therefore, it has the obligation to register the personal data bank it holds in the National Registry of Personal Data Protection, for which the National Authority of Personal Data Protection or General Head Office of Personal Data Protection of the Ministry of Justice and Human Rights is responsible.

The National Authority of Personal Data Protection or General Head Office of Personal Data Protection is the entity in charge of supervising the compliance with law and imposing the sanctions for the non-compliance thereof.

The non-registration of the personal data bank constitutes a serious violation, which can be punishable by fines of up to 50 tax units.

It is worth mentioning that when the personal data base is registered only a description of the data bank is made, that is, the content of the data bank is not transferred to the National Authority of Personal Data Protection.

According to Article 35 of Law N° 29733, Staff of the National Authority of Personal Data Protection is subject to the obligation of keeping confidentiality about personal data it gets to know in the performance of its functions. This obligation lasts even after concluded any relationship with said national authority, under penalty.