PANAMA Law and Practice Contributed by: Rafael Rivera, Javier José Vallarino, Juan Vallarino, Karen Y. Tejeira and Carolina Lino, BDO Legal Panama
or trade secret is any information of an industrial or commercial nature that is maintained as confidential by a natural or legal person, which enables such per - son to obtain or maintain a competitive or economic advantage over third parties in the conduct of busi - ness activities, and with respect to which sufficient measures or mechanisms have been adopted to pre - serve its confidentiality and restrict access thereto.
• Right of Access – to obtain confirmation as to whether personal data concerning them is being processed and to access such data. • Right to Rectification – to request the correction of inaccurate or incomplete data. • Right to Erasure (Cancellation) – to request the deletion of data when it is no longer necessary or is being processed unlawfully. • Right to Object – to object to the processing of their data on legitimate grounds. • Right to Data Portability – to receive their per - sonal data in a structured, commonly used, and machine-readable format and to transmit it to another controller. The data controller must ensure that the exercise of these rights is facilitated in a free and easily accessible manner. Depending on the nature of the request, the controller must respond within five to ten business days. Data Transfers The transfer of personal data, whether domestic or cross-border, is permitted if it is carried out under one of the lawful conditions established by law. These include, among others: • the data subject’s consent; • the recipient country ensures an adequate or higher level of data protection; and • the transfer is made to an entity within the same corporate group as the data controller, provided that the purpose of the processing remains the same. In the case of intra-group transfers, it is essential to implement appropriate safeguards to ensure compli - ance with data protection regulations. Such measures may include maintaining records of transferred data - bases, adopting Binding Corporate Rules (BCRs), or implementing other enforceable self-regulatory mech - anisms. 8.2 Geographical Scope Unlike other jurisdictions, Panamanian data protection regulations apply exclusively to databases domiciled within the territory of the Republic of Panama or in
8. Data Protection 8.1 Applicable Regulations
Data protection is regulated under Law 81 of 2019, which is further regulated by the Executive Decree 285 of 2021. Data privacy laws in Panama describe data as any source of information that identifies or makes identifiable a natural person. The scope of application applies either to public and private entities, whether they are lucrative or not, as well as any other person involved in data treatment. Scope of Application of the Data Privacy Law The Data Privacy Law applies to all databases domi - ciled in the Republic of Panama, as well as to any processing activities carried out by data controllers domiciled in Panama. The Law establishes the guid - ing principles, data subject rights, lawful bases for processing, rules on data transfers, and exceptions applicable to the processing of personal data. Lawful Bases for Data Processing The processing of personal data shall be deemed law - ful if it is based on one of the following legal grounds: • the data subject expresses consent; • processing is necessary for the performance of a contract to which the data subject is a party; • processing is necessary for compliance with a legal obligation to which the data controller is subject; or • processing is authorised by a special law or by
regulations issued pursuant thereto. Data Subject Rights (ARCO Rights)
Panamanian legislation recognises the following rights of data subjects, commonly referred to as ARCO rights.
839 CHAMBERS.COM
Powered by FlippingBook