Introduction

Following the ruling of the Court of Justice of the European Union (CJEU), which invalidated the European Commission’s EU-US Privacy Shield decision—generally known as the “Schrems II” decision¹ —the Uruguayan data protection authority (URCDP) announced on 16 September 2021 its Resolution No. 23/021, under which it, too, found that the EU-US Privacy Shield was no longer considered to provide adequate levels of protection. As a result of that decision, whenever there is an international data transfer from Uruguay to any country that does not provide adequate levels of protection, the Standard Contractual Clauses that enshrine this protection must be used (as outlined in Resolution No. 41/01), or the data processor must obtain an authorization either by the data subject or the URCDP.

Cross-border data transfer regime in Uruguay

Cross-border data transfers are defined in Ordinance H) of article 4 of Decree No. 414/009 (Regulatory Decree), as the “treatment of data that involves a transmission of these outside the national territory, constituting a transfer or communication, and having the purpose of carrying out a treatment on behalf of the data controller or processor established in Uruguayan territory.”

In addition to this, the Data Protection Act (Article 23 of Law 18,331 DPA), prohibits the transfer of personal data of any kind to countries or international organizations that do not provide adequate levels of data protection, except for the cases expressly provided for under the DPA and Regulatory Decree.

Those exceptions are   the following:

1. International judicial cooperation, in accordance with the respective international instrument—this can be a Treaty or a Convention, considering the circumstances of the case;
2. Exchange of medical data, when necessary for the treatment of the affected person or for reasons of public health or hygiene;
3. Bank or stock transfers, in relation to the respective transactions;
4. Agreements within the framework of international Treaties to which Uruguay is a party;
5. International cooperation between intelligence agencies to fight organized crime, terrorism, and drug trafficking.

Likewise, it will also be possible to carry out cross-border data transfers in the following cases:

1. The data subject has unequivocally consented to the planned transfer;
2. The transfer is necessary for the execution of a contract between the data subject and the data controller or for the execution of pre-contractual measures taken at the request of the data subject;
3. The transfer is necessary for the execution of a contract entered into or to be entered into in the interest of the data subject, between the data controller and a third party;
4. The transfer is necessary or legally required for the safeguarding of an important public interest, or for the recognition, exercise, or defense of a right in a judicial proceeding;
5. The transfer is necessary to safeguard a vital interest of the data subject;
6. The transfer takes place from a registry that, by virtue of legal or regulatory provisions, is designed to provide information to the public and is open to consultation by the general public or by any person who can demonstrate a legitimate interest.

In addition, the URCDP may authorize a transfer or a series of transfers of personal data to a third country that does not guarantee an adequate level of protection whenever the data controller offers sufficient guarantees regarding the protection of privacy and the due exercise of the data subject’s rights, such guarantees deriving from appropriate contractual clauses.

Finally, we highlight that according to Article 35 of the Regulatory Decree, international data transfers of multinational companies, are allowed when the transfer is between the parent company and its subsidiaries or branches and among any of them, provided they have proper codes of conduct duly registered with the URCDP.

Resolutions No. 23/021 and 41/021 of the URCDP

Resolution No. 23/021 (the Resolution), which replaced Resolution No. 4/019, of March 12, 2019, lists those countries and organizations that the URDCP considers as providing adequate and appropriate levels of data protection for international data transfers. They are the following:

1. Members of the European Union and European Economic Area
2. Andorra
3. Argentina
4. Canadian private sector
5. Guernsey
6. Isle of Man
7. Faroe Islands
8. Israel
9. Japan
10. Jersey
11. New Zealand
12. UK
13. Switzerland

As noted above, in the wake of the CJEU ruling the URCDP also ruled that the US Privacy Shield is no longer considered to provide adequate levels of protection and therefore is no longer suitable for international data transfers. Thus, international data transfers made to the US must now either be justified through the consent of the interested parties (and data subjects), by the subscription of a data transfer contract, or if the transfer falls under any of the exceptions provided for by Article 23 of the DPA, as noted above.

In addition, Resolution No. 41/021 of the URCDP furthers the new regime, by making available to data controllers and data processors a guide on advising on the minimum content to include in a data transfer contract. This guide will also, in turn, serve as an example of good practices and proof of compliance as required by Article 23 of the DPA.

We note that the guide does not include the outright text of the clauses to be used, but rather contains some stipulations considered of utmost importance and as the minimum content of any data transfer contract (i.e.   the purpose of the transfer, the data subject’s right to information, where the data will be transferred, definition of importer and exporter, confidentiality, dispute resolution mechanisms, communication of data breaches).  In any case, the transfer contract must stipulate that in the event of non-compliance, the competent administrative authority must be the Uruguayan, except for cases in which the data importer is subject to a regulatory authority in the country of destination.

Finally, if the personal data is being provided to a country which the URCDP considers “not adequate” (according to the Resolution), the data processor must first undergo an Data Protection Impact Assessment.

1. Judgment of 16 July 2020, Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems, C-311/18