Personal Data Protection: new requirements for automated data processing.
Uruguay recognizes the right of all individuals - both physical and legal persons - to have their personal data, stored in public or private databases, treated properly, and not used for purposes that have not been previously informed (Law No. 18,331 - "Personal Data Protection Law" - and its regulatory Decrees No. 414/009 and 64/020).
With the approval of Law No. 20,075 ("Law on Accountability and Execution Budget Balance. Balance 2021"), modifications related to automated processing of personal data were introduced.
What are the main modifications?
1) From January 1, the database manager has the duty to inform data subjects, in a clear, precise, and unequivocal manner:
(i) when personal data is going to be transferred outside of Uruguay ("international transfer"), and
(ii) in the case of automated data processing, what are the evaluation criteria, programs used, and processes applied.
As a result of this modification, the data subject has the right to know - in advance - the technological solutions used to evaluate aspects such as: work performance, credit, reliability, behavior, among others.
This adds to the conditions already established by the Personal Data Protection Law regarding the processing and collection of personal data, which required informing:
- Purpose for the processing of personal data, as well as recipient/s of the data.
- Existence of the database and information about its manager.
- When a questionnaire is proposed to the data subject - especially in the case of sensitive data - indicate if the answers are mandatory or optional.
- Consequences of providing the data or refusing to do so (or doing so inaccurately).
- The right to access the information collected, request its rectification, updating, and even its deletion.
2) Finally, the Regulatory and Control Unit of Personal Data is given the power to establish the criteria and procedures that database managers and processors must follow in the case of automated processing of personal data.
Montevideo, January 13, 2021.
*Article of purely informative nature prepared with the collaboration of Attorney Gabriela Ripoll.
