Uruguay: New Proposed Changes on Personal Data
URUGUAY
New proposed changes on personal data
On March 1st, 2020, a new government took office in Uruguay and a new budget law for the 2020-2024 period (hereinafter, “Budget Bill”) was proposed to the Parliament. The Budget Bill has not yet been approved, but in case the same is approved, it will introduce various changes, including certain related to personal data matters.
In relation to data protection matters, the Budget Bill proposes certain modifications to Law No. 18.331, “Data Protection Act” (hereinafter, “DPA”), by expressly providing that biometric data is considered personal data and including its definition. In this sense, article 79 of the Budget Bill, would amend Article 4 of the DPA by incorporating the definition of biometric data as personal data resulting from a specific technical processing, relating to the physical, physiological or behavioral characteristics of an individual that allows or confirms the unique identification of that individual such as dactyloscopic data, image or voice recognition.
With regards to the consent for processing biometric data, article 80 of the Budget Bill would add article 18 BIS to the DPA, which would provide that biometric data may only be processed with the prior informed consent of the data subject as provided in article 9 of the DPA and with a prior impact assessment evaluation regarding the protection of personal data.
Article 9 of the DPA provides that the processing of personal data shall be lawful whenever the subject has provided free, prior, explicit and informed consent, which shall be documented. Prior consent shall not be required in the following cases: A) Data coming from public sources of information, such as records or publications in the mass media; B) Data obtained for the exercise of duties inherent to the government powers or under a legal obligation; C) Listings containing data limited, in the case of individuals, to names and surnames, identity documents, nationality, address and date of birth; D) Data arising from a contractual, scientific or professional relationship of the data holder, and necessary for their development or compliance; and E) Data processed by natural for their exclusive, personal or domestic use.
Furthermore, the Budget Bill introduces in article 181 the creation, within the control of the Internal Affairs Ministry (“Ministerio del Interior”), of a "Facial Identification" database for its administration and processing for public security purposes.