Argentina Ratifies the Convention 108+ on Personal Data Protection

What Does It Mean?

On November 9, 2022, the Argentine Congress approved the Convention 108+, which amends Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data No. 108. Although Argentina had signed Convention 108+ in 2019, its ratification by the Legislative Power remained pending.

Convention 108 is an international treaty adopted in 1981 within the Council of Europe, premised on the idea that the overall protection of personal data would only be effective if established through binding international standards. To date, it remains the only mandatory international instrument in this field. According to Article 23, the Convention is open to the accession of non-member states of the Council of Europe. Uruguay was the first non-European country to adhere to the Convention in August 2013. In the region, Mexico also joined in 2018, followed by Argentina in 2019.

Convention 108 aims to guarantee the rights and freedoms of individuals concerning the automated processing of their personal data.

Among other issues, the Convention regulates essential principles such as data quality (obtaining data transparently, for legitimate and specific purposes, and not retaining it for longer than necessary for fulfilling those purposes), the rights of data subjects (known as “ARCO” rights: access, rectification, cancellation (or deletion), and opposition), database security standards, and the regime governing cross-border data flows.

It also establishes particular categories of data, such as those revealing racial origin, political opinions, religious or other beliefs, data concerning health, sexual life, or criminal convictions. These categories cannot be processed automatically unless adequate legal guarantees are provided.

Finally, a Permanent Consultative Committee is responsible for presenting proposals to facilitate and enhance the Convention’s implementation.

Convention 108+, adopted in May 2018 and open for signature by interested countries in October of the same year, has two main objectives: addressing the challenges of new technologies and strengthening the effective application of Convention 108.

Convention 108+ involves an update on several levels:

• Firstly, it updates terminology: it removes the concept of “file,” now obsolete; replaces the “data controller” with the more precise term “data processor,” and adds essential categories like the “data processor,” i.e., the one who processes data following the controller’s guidelines;
• It excludes processing for personal or domestic purposes, and significantly eliminates the possibility for States to exempt special categories of data, such as those related to national defense and security;
• It expands the category of special data, including genetic, biometric, ethnic origin, and trade union membership data;
• It restates data quality criteria, details the information to be provided when collecting personal data, and outlines the rights belonging to data subjects, including some newer rights, such as not being subject to decisions based solely on automated data processing;
• It updates the regime for cross-border data flows to adapt to the massive electronic transfers occurring presently;
• Concerning security, it establishes the obligation to notify the supervisory authority of any security incident that could significantly interfere with data subjects’ rights and freedoms;
• Data controllers and processors must not only adopt appropriate measures but also demonstrate compliance with their obligations under the Convention;
• Compliance checks also extend to States, as the Consultative Committee can evaluate the effectiveness of measures adopted by the States, requiring active contribution from the latter in this evaluation process;
• Lastly, the Convention is open not only to non-European states but also to international organizations; in fact, the subscription of the European Union is already foreseen in the new text.

Adhering to Convention 108+ represents a significant advancement in recognizing and protecting personal data and informational self-determination as essential elements in the country’s state policy.

Like other countries in the region (with Brazil and Ecuador leading the way), Argentina has begun a process to replace its data protection law, Law 25.326, largely following the criteria of the European GDPR. The Agency of Access to Public Information drafted a Preliminary Law which, after being subjected to a public consultation involving civil society participation, has become a Bill whose parliamentary process is expected to commence shortly (the Bill’s text can be accessed via this link: https://bit.ly/3GiA66n).

Moreover, ratifying the Convention will assist Argentina in maintaining its status as a country providing an adequate level of protection for international data transfers, which, according to the GDPR, must be reviewed by the European Commission at least every four years (cf. Art. 45.3).