Supervision and control rules of the Personal Data Protection Agency (Disposition No 5/2008)

The Argentine Personal Data Protection Agency (the “Agency”), through Disposition No 5/2008 (the “Disposition”), has approved the proceedings that will govern the supervision and control the Agency will carry out in order to verify the fulfillment of the Data Protection regulations by owners and/or users of databases.

The Disposition provides that supervision and control will be ordered by the Agency when it deems appropriate. Its execution will be ordered by the proper decision of the Agency Director with a prior notice of not less than 10 working days unless a justified reason requires executing the audit without the prior notification.

The audit will be conducted by inspectors, who are employees of the Agency, and technical staff.

Pursuant to the Disposition, the inspection will consist in one or more visits to the company by the appointed inspector, in which he may have access to the company’s premises, equipments, and/or software processing personal data of the database owner. Although these visits will be carried out in working days and hours, at the Agency’s initiative or upon request of the party, it may take place outside that schedule.

During the supervision and control, the inspector shall verify if the database owner complies with the duties regarding data protection, such as staff training; proper collection, processing, management, assignment, removal of personal data; documents such as the registration certificate issued by the Registry of Databases; compliance with security measures for the processing and storage of personal data, etc.

The inspector will issue a minute in duplicate stating the outcome of the inspection. The minute will be signed by those who participated in the inspection and the owner of the database.