Court Decision Clarifies Concept of Sensitive Data

The Argentine Court of Appeals on Civil Matters has recently clarified that the context in which data is collected and processed matters when determining if it should be considered sensitive data (Argentine Court of Appeals in Civil Matters, Docket No. 8735/2018, “Instituto Patria v. IGJ”, May 24, 2018).

The facts of the case are as follows: The PATRIA Institute, a political institute from Buenos Aires, was asked to hand over its Associates Registry Book to the Public Registry of Commerce (IGJ after its Spanish acronym) to comply with a regulation requiring such disclosures to approve its financial statements for the 2016 period. PATRIA refused, arguing that this registry would constitute information on political ideology, which is sensitive personal data according to Argentine Data Protection Law No. 25,326 (DPL) and cannot be disclosed without the consent of the data subject. In turn, the IGJ argued that names alone are not sensitive data under the DPL. PATRIA did not agree and insisted on its position

After some time of not receiving the Associates Registry Book, the IGJ imposed sanctions on PATRIA and ordered the disclosure of the names. PATRIA appealed the decision before the Appellate Court.

The Civil Court of Appeals began its opinion by reaffirming one of the DPL’s principal aims, which is that of protecting the sensitive personal data of the data subjects and the rights implicated by that protection. It also stressed the role that consent plays in the collection and use of personal data. Sensitive personal data includes data which reveals political opinions and organizational membership, which can be used as a basis for discrimination or prejudice.

The Court then looked at PATRIA’s essential mission, which is to advance political ideals in the region. It held that associates’ ideologies are inextricable from PATRIA’s political mission and that consequently having one’s name associated with the group indicated one’s ideology. Therefore, while names alone are not usually protected as sensitive personal data under the DPL, the Court held that in this context they were sensitive.

Hence, the Court ordered that the IGJ’s sanctions be lifted and that it cease its requests for PATRIA’s Associate Registry.

By creating a context-based method of finding previously non-sensitive personal data to be sensitive under specific circumstances, the Court expanded the protections offered by the DPL.