The Law for the Protection of Personal Dat 8968, “Protección de la Persona Frente al Tratamiento de sus Datos Personales”, was enacted and entered into force on September 5th, 2011. According to the first article, this law aims to “(…) guarantee to every person, regardless of nationality, residence or domicile, respect to their fundamental rights, specifically, the right to informational self-determination, in relation to their life and sphere of private activity and rights related to the personality, as well as the defense of freedom and equality regarding the automatic or manual data treatment pertaining the person or property.”

It is important to emphasize the definition of “Personal Data” in accordance with the legislation in force regarding personal data protection, which considers it as “Any information concerning to an identified or identifiable individual”. The provision set forth previously, shall be deemed as the duty imposed on the entity, who recruited such personal information in a database, to inform those holders or their representatives regarding the implications involved when providing this information.

The Law for the Protection of Personal Data and its Rulings Information were enacted on March 5th, 2013, which entered into force on the same date. This new regulation pretends to ensure the implementation of the above-mentioned law, by assigning the “Agencia de Protección de Datos de los Habitantes (PRODHAB)” as the competent authority to hear complaints, being responsible for implementing this new liability regime.
This regulation attempts to establish the rights and duties of the parties, the individual and the person or company that collects the data; it also includes the complaint procedures, the administrative process and their respective penalties.

The scope of this law and its regulation is defined and delimited as “(…) the personal data contained in manual or automated databases, of public or private agencies, and to any type of subsequent use of these data”. The consent of the owner of the data must be expressed and obtained in writing, either in physical or electronic documents, and even may be revoked later as set forth in the regulation.

Two highly significant concepts involved in this regulation and worth mentioning are the following:

• Informational self-determination, understood as the fundamental right of every individual to control the flow of information about him, derived from the right to privacy.
• The right to be forgotten, established in article 11 of the Regulation: “The conservation of personal data, which may affect the individual, shall not exceed ten years from the date of occurrence of the events recorded, unless special regulations establishing another period or because an agreement between the parties established a shorter period. If it is necessary keep such records beyond the stipulated period, the personal data must be disassociated from the person.”