ECUADOR Law and Practice Contributed by: Sebastian Corral Guevara, Miguel Pizarro Páez, María Fernanda Mencías Pérez, José Cisneros Pazmiño, Roque Bustamante Espinosa and Jorge Pizarro Páez, Flor Bustamante Pizarro & Hurtado
fy personal data security breaches to the competent authority where required by law. The authority responsible for supervising and enforc - ing the LOPDP is the Superintendence for the Protec - tion of Personal Data ( Superintendencia de Protección de Datos Personales – SPDP), which is empowered to investigate infringements, issue administrative guid - ance and impose the sanctions established by law. 8.2 Geographical Scope The LOPDP has an extraterritorial scope broadly com - parable to that of the GDPR. The LOPDP applies to the processing of personal data carried out within Ecuador, irrespective of whether the controller or processor is established in Ecuador. It also applies to controllers or processors established outside Ecuador where the processing activities relate to: • the offering of goods or services to individuals located in Ecuador; or • the monitoring of the behaviour of individuals located within Ecuador. Accordingly, a foreign company that targets custom - ers in Ecuador or monitors the behaviour of individuals located in Ecuador may be subject to the obligations established by the LOPDP, including compliance with the applicable principles governing the processing of personal data and the recognition of the rights of data subjects. International transfer of personal data is permitted where the requirements established under the LOPDP are satisfied. As a general rule, transfers may be car - ried out where the data subject has provided valid consent or where another lawful transfer mechanism applies, including transfers to jurisdictions providing an adequate level of protection, appropriate contrac - tual safeguards, binding corporate rules for corporate groups or any other transfer mechanism recognised by Ecuadorian law. 8.3 Role and Authority of the Data Protection Agency The authority responsible for supervising and enforc - ing Ecuador’s data protection framework is the SPDP, an independent public authority with administrative,
technical, operational and financial autonomy. The SPDP is responsible for overseeing compliance with the LOPDP and its implementing regulations. Its prin - cipal powers include: • supervising compliance with the LOPDP; • administering the National Data Protection Regis - try; • issuing secondary regulations, technical guidance and administrative criteria concerning the applica - tion of the data protection framework; • handling complaints and petitions submitted by data subjects; • conducting investigations and administrative inspections; • initiating and deciding administrative enforcement proceedings; and • imposing the corrective measures and administra - tive sanctions provided by law. Where the SPDP determines that an infringement has occurred, it may order corrective measures, require the adoption of compliance measures and impose administrative fines in accordance with the LOPDP. Since becoming operational, the SPDP has progres - sively developed its supervisory and enforcement activities, particularly in relation to compliance pro - grammes, privacy by design and by default, the pro - cessing of biometric data, and the implementation of appropriate technical and organisational security measures. Several legislative and regulatory developments are expected to continue shaping Ecuador’s legal frame - work in the short-to-medium term. Tax Further tax reforms remain likely as part of the govern - ment’s fiscal policy and efforts to promote investment and strengthen tax collection. Recent reforms have focused on modernising tax compliance, expand - ing digital tax administration, updating withhold - ing tax regimes and strengthening tax transparency 9. Looking Forward 9.1 Upcoming Legal Reforms
304 CHAMBERS.COM
Powered by FlippingBook