The final legal step required for Argentina to ratify Convention 108+ and make it domestic law was completed on April 17, 2023, by the Director of the Agency of Access to Public Information.
This ratification signifies the incorporation of several important provisions into Argentine law. These include a clear definition of "data processor," the express inclusion of genetic and biometric data within the special categories of data, and the obligation for data controllers to notify the Controlling Authority without delay of any security incidents that could seriously affect the fundamental rights and freedoms of data subjects.
Moreover, Convention 108+ also brings with it several new rights for data subjects, such as the right not to be subject to decisions based solely on automated data processing, especially when these decisions are likely to significantly impact them, and their views have not been considered. Additionally, data subjects now have the right to know the reasoning underlying the data processing when its results are applied to them.
Additionally, Convention 108+ incorporates the accountability principle and expands the scope of the right to object to all processing of personal data.
The Convention also mandates that data controllers and processors assess the possible impacts that data processing may have on the fundamental rights and freedoms of the data subjects prior to initiating such processing. Additionally, the introduction of mechanisms to guarantee privacy by design and the implementation of additional regulations concerning consent as a legal basis for the international transfer of personal data are now required.
For Convention 108+ to become effective, it must be ratified by at least thirty-eight Parties. Once the required threshold is met, all provisions of Convention 108+ will take immediate effect for the Parties to the Protocol.
Article provided by INPLP member: Diego Fernandez (Marval O’Farrell Mairal, Argentina)
Dr. Tobias Höllwarth (Managing Director INPLP)