Argentina approves and Becomes a Party to Convention 108+

Last November 9, the House of Representatives approved Argentina's accession to the Protocol Amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ("Convention 108+"). The Convention 108+ had been signed by Argentina in September 2019 and approved by the Senate in 2022. In this context, Argentina became the thirty-third party to the Convention, and the third Latin-American party, with Mexico and Uruguay.

Some of the principles introduced by Convention 108+ are:

• It incorporates the definition of "data processor".
• It expressly includes genetic data and biometric data within the special categories of data.
• It establishes the obligation of data controllers to notify, without delay, at least the Controlling Authority of security incidents that may seriously affect the fundamental rights and freedoms of data subjects.
• It broadens the information that data controllers must provide to data subjects, including, among others, the legal basis for the processing and the categories of personal data processed.
• It recognizes new rights for data subjects, such as the right to not be subject to decisions based solely on automated data processing when these decisions are likely to significantly affect them and when their views have not been considered, and the right to know the reasoning underlying the data processing when its results are applied to them.
• It broadens the scope of the right to object to all processing of personal data.
• It incorporates the principle of accountability.
• It establishes the obligation of data controllers and processors, where applicable, to assess the possible impacts that the data processing may have on the fundamental rights and freedoms of the data subjects prior to commencing such processing.
• It introduces the obligation to adopt mechanisms to guarantee privacy by design.
• It introduces additional regulations regarding consent as a legal basis for the international transfer of personal data.

In addition, member States undertake to cooperate and assist each other in the implementation of the Convention, as well as to assist all data subjects, regardless of their nationality, in exercising their rights.

Finally, Convention 108+ provides for the creation of a Convention Committee whose functions include developing or approving standardized model warranties for the international transfer of data.

The Convention 108+ was recently approved by Law No. 27,699. Ratification by the Executive Branch is still pending.