New Bill for Protecting Biometric Data

On April 11, 2024, a Bill was introduced with the Province of Buenos Aires Legislature to regulate the relationships between users and providers of digital applications within the Province of Buenos Aires.

The most relevant aspects of the Bill include:

• Biometric data is defined as “specific and unique data obtained from a person’s physical features, such as by scanning their faces, irises, fingerprints, among others, that can be used to identify, authenticate, or verify the identity of the individual.”

• Certain duties are established for providers of digital services, similar to those in the Data Protection Law 25326 (DPL), including:

(a) the duty to register, in the Provincial Registry of Digital Applications of Biometric Data, adhesion contracts users must sign,

(b) the duty to inform the purpose, place of storage, transfer, and grounds for using the data,

(c) requiring free, explicit, and informed consent for processing biometric data.

• Digital providers must include terms and conditions related to the collection, storage, and use of personal data. The Bill also states that security measures and safeguards must be implemented to ensure that consumers' data are treated confidentially and used exclusively for the purposes previously informed to and consented by users.

• In accordance with the DPL, users have the right to access, rectify, update, and delete biometric data providers collect. Users also have the right to report providers’ abusive behaviors.

• The Bill establishes sanctions in the event of non-compliance.