New Preliminary Draft for Replacing the Argentine Data Protection Law

Some of the main changes to the current data protection regime include:

• Incorporating new definitions such as "anonymization", "informational self-determination", "profiling", "biometric data", and "genetic data".
• Eliminating legal entities as data subjects.
• Changing the definition of sensitive data including as reference only the current categories of sensitive data listed in the Personal Data Protection Law and defining it as “any information that may give place to discrimination”, including biometric and genetic data.
• Regulating the extraterritorial application of the Law.
• Introducing the concept of accountability. 
• Recognizing new legal bases beyond consent for processing personal data, including legitimate interest.
• Specifically, regulating the personal data processing of minors.
• Introducing the obligation for data controllers to report security incidents to the data protection authority and, under certain circumstances, to data subjects.
• Recognizing new rights such as the right to object to the processing of personal data (not limited to marketing uses as before), the right to data portability, and the right to not be subjected to decisions based solely or partially or automated processed data.
• Creating the obligation, under certain circumstances, of carrying out data impact assessments, and establishing the minimum contents of the assessment.
• Introducing the concept of the data protection officer and the obligation to appoint one in certain cases. 
• Introducing the need to appoint a representative in Argentina when the data controller or data processor bound by the Preliminary Draft is not settled in the country.
• Creating the Data Protection National Registry, in which data controllers and data processors -which are required to appoint a DPO and/or a Representative- must be registered.
• Providing certain regulations regarding data subjects’ profiling and scoring.
• Establishing that the data protection authority may impose the following sanctions, among others: (a) suspension of activities related to the processing of personal data, (b) closure of operations involving the processing of sensitive data and data of minors.
• The data protection authority may impose fines from 5 to 1,000,000 adjustable units (approximately USD 70,000,000, at the current exchange rate), or from 2% to 4% of the  preceding financial year total worldwide annual turnover. The initial value of the adjustable unit will be of ARS 10,000 (approximately USD 70, at the current exchange rate) and will be updated annually according to the INDEC Customer Price Index. 

The data protection authority will receive comments regarding the Preliminary Draft until September 30.

“EDITOR'S NOTE: Based on Resolution 145/2022 AAIP, the Agency for Access to Public Information has extended the period for public consultation until October 11, 2022 for the presentation of proposals and opinions on the Preliminary Draft.”