Personal Data Protection: Changes in the Range of Penalties for noncompliance with Law No. 26,951.
On February 24, 2015, Decision No. 9/2015 dated February 19, 2015 issued by the Argentine Personal Data Protection Bureau (“DNPDP” for its Spanish acronym) (the “Decision”) was published. The Decision amended Annexes I and II to Section 2 of Decision No. 7/2005 issued by the DNPDP.
As a consequence of the enactment of Law No. 26,951, which created the NATIONAL “DO NOT CALL” REGISTRY, and of the appointment of the DNPDP as Enforcement Authority, which was also assigned the power to impose penalties for noncompliance with such law, it was necessary to amend the regulations in force, including new acts or omissions that imply a violation of both rules.
Upon changing the system of violations and penalties in force, the Decision established new levels in the “Ranges of Penalties” within the parameters established in section 31 of Law No. 25,326, as follows:
(i) “minor violations”: penalties of “up to TWO (2) warnings” and/or “fine ranging from ARGENTINE PESOS ONE THOUSAND (AR$ 1,000.-) to ARGENTINE PESOS TWENTY-FIVE THOUSAND (AR$ 25,000.-);
(ii) “major violations”: penalties of “up to FOUR (4) warnings”, “suspension from ONE (1) day to THIRTY (30) days” and/or “fine ranging from ARGENTINE PESOS TWENTY-FIVE THOUSAND, ONE (AR$ 25,001) to ARGENTINE PESOS EIGHTY THOUSAND (AR$ 80,000.-);
(iii) “severe violations”: penalties of “up to SIX (6) warnings”, “suspension from THIRTY-ONE (31) days to THREE HUNDRED, SIXTY-FIVE (365) days”, “closure or cancellation of the filing system, registry or databank” and/or “fine ranging from ARGENTINE PESOS EIGHTY THOUSAND, ONE (AR$ 80,001.-) to ARGENTINE PESOS ONE HUNDRED THOUSAND (AR$ 100,000.-).
The Decision establishes that the maximum of warnings the authority may apply is six (6) and that the imposition and amount of the penalties shall depend on the nature of the personal rights that were affected, the volume of data treated, the benefits obtained, the degree of intention, whether it was a second offense, the damages caused to the persons concerned and third persons, and any other circumstance that may be relevant to establish the degree of unlawfulness and responsibility in the actual violation.
The owner of the database that, having been punished once, commits a new violation of a similar nature within the term of three (3) years as from the imposition of the prior penalty shall be considered a second offender. Failure to pay the fine shall allow its collection by means of the pertinent proceedings and a certified copy of the unappelable and final resolution whereby such fine is imposed shall suffice as execution paper.
The Decision became effective on February 24, 2015, i.e., upon publication in the Official Bulletin.