Exceptions to Consent Ruled Unconstitutional

On 30 April 2026, the Argentine Supreme Court issued its ruling in the case “Torres Abad, Carmen c/ EN – JGM s/ hábeas data” declaring unconstitutional articles 5(2)(b) and 11(3)(b) and (c) of the Argentine Personal Data Protection Law 25326. The first article provides that consent is not required where personal data are collected for the exercise of functions inherent to the powers of the State or pursuant to a legal obligation. Paragraphs (b) and (c) of article 11 provide that consent is not required in the circumstances set forth in article 5(2), nor where data are transferred directly between government agencies when carrying out their corresponding functions.

The case arose when Torres Abad challenged the use of her telephone number and email address, which she had provided to ANSES (Argentina’s social security agency) in connection with her retirement application, for a purpose different from that for which the data had originally been collected. The data had been transferred to another government agency to send institutional communications without the data subject´s authorization.

In its opinion, the Supreme Court held that consent is not merely a statutory requirement but a constitutional imperative deriving from the rights to privacy and informational self-determination protected by articles 19 and 43 of the Argentine Constitution. 

The Supreme Court acknowledged that the challenged provisions authorized the conduct carried out by ANSES and that, for that very reason, they were incompatible with the Constitution.

On that basis, the Supreme Court stated that any exception to the consent requirement is constitutionally valid only if it: 

1.    is established by a formal law; 
2.    pursues a sufficiently weighty and specific legitimate interest; 
3.    is proportionate to the objective pursued; and 
4.    does not impair the essence of the restricted right.

According to the Supreme Court, the challenged provisions failed to satisfy this constitutional test for two reasons. First, as to their scope, the Court noted that an exception based solely on the fact that the processing or transfer of personal data falls within the competence of a government agency effectively encompasses the entirety of administrative activity, since competence is always a prerequisite for the validity of governmental action. As a result, the exception becomes the rule, depriving the constitutional protection of meaningful effect. 

Second, as to their reasonability, the Court observed that the provisions identify no specific legitimate interest capable of justifying the processing or transfer of personal data without consent, and make no distinction based on the type of public agency involved, the nature of the information processed, or the degree of impact on the privacy of the individuals concerned. Nor are the exceptions aimed at protecting any of the overriding interests that, according to the Court’s own jurisprudence, may justify restrictions on privacy rights, such as the rights of others, the protection of society, public morals, or the prevention and prosecution of crime.

Based on these considerations, the Supreme Court held that the articles under review were unconstitutional. The Court’s decision is limited to the case under review, namely, the processing and transfer of data between government agencies.