On September 12, a new Preliminary Data Protection Bill was published in the Official Gazette. This bill has been presented by the Agency of Access to Public Information (AAIP) and shared with the public and private sectors for comments a couple of weeks ago.

The Preliminary Bill emphasizes the need to update the current Law (sanctioned in 2000), to adjust it to the European General Data Protection Regulation and the Brazilian General Personal Data Protection Law.

The main issues addressed by the Preliminary Bill are as follows:

• it limits the scope of the concept of data subjects to human persons, thus legal entities are now excluded as a data subject.
• It introduces new definitions such as the concept of data base, personal data and sensitive data. Together, with new concepts concerning genetic data, biometric data and economic group.
• it widens the application of the Bill to foreign companies even if they are no registered locally, so as to guarantee the full enjoyment of subject data’s rights. In this case, foreign companies must appoint a local representative.
• it introduces the legitimate interest as a new ground for the collection and processing of personal data.
• Minors of 13 years of age and older do not need parental consent.
• It establishes new provisions regarding sensitive data, especially the cases when it can be legally treated and processed.
• It introduces cases when the international transfer of personal data is legal.
• It sets the obligation to report to the controlling authority and data subjects any security incident.
• It extends data subjects’ rights by including the right to oppose to the processing of their data and the right to data portability, if technically feasible.
• It sets the obligation to appoint a Data Protection Delegate.
• data controllers shall conduct impact evaluations in those cases in which the treatment of data may affect data subjects’ rights.
• It increases the penalties for infringement.

Next step for the Preliminary Bill is to be debated in the Argentine Congress, and, if approved, a grace period is granted for compliance.