New MERCOSUR Agreement on Electronic Commerce

The Permanent Representatives of MERCOSUR, recognizing the need for a uniform, transparent, and predictable legal framework that enshrines the rules and principles governing electronic commerce in the MERCOSUR, and with the purpose of taking advantage of the potential of digital channels as instruments of economic and social development, approved an Agreement on Electronic Commerce through an exceptional procedure provided under MERCOSUR/CMC Decree No. 02/20 (available in Spanish here).

The Agreement on Electronic Commerce includes rules on electronic authentication, advanced electronic signatures and digital signatures, personal data protection, and electronic cross-border information transfer, among others.

Regarding electronic authentication, advanced electronic signatures and digital signatures, the Agreement on Electronic Commerce provides that MERCOSUR Member States:

• Shall not deny the legal validity of signatures solely on the basis that those signatures are made electronically (unless otherwise expressly provided in their respective legal systems).
• Shall not adopt or maintain electronic authentication measures that prohibit the parties to an electronic transaction from mutually determining the appropriate authentication methods for that transaction or that prevent the parties to such transaction from having the opportunity to prove to judicial or administrative authorities that their transaction complies with applicable legal authentication requirements.
• Shall encourage the interoperable use of advanced electronic signatures and digital signatures.
• Shall provide the necessary means for the execution of mutual recognition agreements concerning advanced electronic signatures or digital signatures.
   

As for personal data protection, the Agreement on Electronic Commerce states that Member States:

• Shall adopt or maintain laws, regulations, or administrative measures for the protection of personal data of electronic commerce users, taking into consideration current international standards.
• Shall apply an adequate level of protection to personal data received from another Member State, by means of laws, regulations or, alternatively, mutual agreements and broader international frameworks (admitting, for the private sector, self-regulation systems).
• Shall encourage the adoption of security measures in relation to the processing of users' personal data and inform users of their rights to access, rectify or delete their personal data.
• Shall also provide the necessary means to establish common measures for the protection and free circulation of personal data within the MERCOSUR.

With respect to electronic cross-border information transfers, the Agreement on Electronic Commerce sets forth that Member States:

• May implement and/or maintain their own regulatory requirements (including those for the protection of personal data, while complying with the provisions of the Agreement in that regard).
• Shall, notwithstanding the foregoing, authorize cross-border information transfers whenever necessary for business conduction. Nonetheless, the Agreement clarifies that Member States may restrict those transfers to achieve a legitimate public policy aim, provided that the restrictions are not applied arbitrarily or conceal a restriction on trade.

The Agreement on Electronic Commerce incorporates additional provisions regarding online consumer protection, location of computer facilities, access to and use of the Internet for electronic commerce, unsolicited direct commercial communications, facilitation of electronic commerce, exchange of information for cooperation purposes, and customs duties.

The Agreement on Electronic Commerce will enter into force thirty (30) days after the ratification instrument is deposited by the second MERCOSUR Member State.