Argentina Ratifies Convention 108+

On April 17, 2023, the Director of the Agency of Access to Public Information, deposited the ratification documents, the last formal requirement for Convention 108+ to become domestic law in Argentina.

Therefore, Convention 108+ would incorporate the following:

• A definition of "data processor".
• Express inclusion of genetic data and biometric data within the special categories of data.
• Obligation of data controllers to notify, without delay, at least the Controlling Authority of security incidents that may seriously affect the fundamental rights and freedoms of data subjects.
• Broader information to be provided to data subjects, including, among others, the legal basis for the processing and the categories of personal data processed.
• New rights for data subjects, such as the right not to be subject to decisions based solely on automated data processing when these decisions are likely to significantly affect them and when their views have not been considered, and the right to know the reasoning underlying the data processing when its results are applied to them.
• A broader scope of the right to object to all processing of personal data.
• Incorporation of the accountability principle.
• Obligation of data controllers and processors, where applicable, to assess the possible impacts that the data processing may have on the fundamental rights and freedoms of the data subjects prior to commencing such processing.
• Introduction of the obligation to adopt mechanisms to guarantee privacy by design.
• Introduction of additional regulations regarding consent as a legal basis for the international transfer of personal data.

Convention 108+ shall enter into force in respect of those States which have expressed their consent to be bound by it, if it has at least thirty-eight Parties. As between the Parties to the Protocol, all provisions of the Convention 108+ shall have effect immediately upon entry into force.