Laws for the protection of privacy have been adopted worldwide. Peru was an innovator in the field of data privacy with the issuance of Law N° 29733, Data Protection and Privacy Law, in 2011. The principle of this law is that individuals should have control over their personal information for it to be used appropriately. The effective force of this Law was made conditional on the issuance of the Regulations thereunder, which were published in May 2013.
The Peruvian Personal Data Protection Authority, the entity entrusted with the task of enforcing compliance with the Law, may impose fines up to US$135,700.00 in case of infringements.
Below are the most important considerations from the Data Protection and Privacy Law:
- The dispositions shall apply to the processing of personal data which form part of filing systems or are intended to form part of a filing system within the Peruvian territory.
- For the processing of personal data, it is necessary to obtain the data subject´s consent which must be free, express and unequivocal. Potential exceptions are: data contained in sources freely accessible to the public, cases where anonymity procedures have been applied, or cases of economic or financial interest between others" Personal data subjects have the right to access, rectify, update, include, cancel and/or eliminate their data, even object to the processing of such data. Special protection has also been afforded to the personal data of minors.
- The Controller of personal data must register Personal Data Filing Systems before the Peruvian Register. The registration procedure takes 30 days.
- The Controller of personal data must take appropriate security measures to protect the information. The Authority has established the minimum security requirements and conditions to be fulfilled within a maximum term of 2 years.
- Personal Data can be transferred from Peru to a third country only if the recipient country affords protection levels consistent with those contemplated under Peruvian Law. Otherwise, the controller must guarantee that the processing of the personal data will comply with the Peruvian dispositions.
Although the Law has been in force for almost a year, only 90 Personal Data Filing Systems have been registered. The Authority has a difficult task in this new field since it must assure that the fundamental rights and freedoms of persons are respected and, at the same time, the guidelines to be issued over the matter must be aligned or equivalent to those in other countries.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.