PANAMA Trends and Developments Contributed by: Inocencio Galindo, Omar Rodriguez, Maria Eugenia Brenes and Joy Paull Torres, Morgan & Morgan
or health data), the report must first go to the relevant regulator. If that authority does not respond, the case
• consult legal counsel – determine whether the breach meets the threshold for criminal reporting; • file a complaint with the Public Ministry – if criminal conduct is suspected, a formal complaint should be submitted; and • co-operate with investigations – provide all requested documentation and access to systems as needed. Law 81 of 2019 empowers individuals and holds organisations accountable for the protection of per - sonal data. Reporting breaches promptly and under - standing when they cross into criminal territory is essential for compliance and ethical responsibility. By following the law’s procedures and co-operating with authorities, organisations can mitigate risks and contribute to a safer digital environment in Panama. In Panama’s current socio-economic context, data protection is increasingly tied to consumer trust, digital transformation and international compliance. Businesses that fail to report breaches or mishandle personal data risk reputational damage, financial pen - alties and legal consequences. Moreover, with growing concerns around cybercrime, identity theft and digital fraud, Law 81 serves as a criti - cal tool for safeguarding citizens’ rights and ensuring accountability. Crimes involving data breaches are often under- reported, leaving victims vulnerable to further exploi - tation. In many cases, individuals or organisations may be subjected to ransom demands, extortion, blackmail or threats following unauthorised access to their personal or confidential data. Criminals may use stolen information to pressure victims into silence or payment, especially when the data involves sensitive financial, health or reputational details. The fear of reputational damage or legal consequences often dis - courages victims from coming forward, which allows these criminal practices to continue unchecked. For this reason, it is crucial to report a data breach immediately – not only to the relevant data protection authority (ANTAI) but also to law enforcement if crimi - nal conduct is suspected. Early reporting helps pre - vent further harm, enables authorities to investigate
should be escalated to ANTAI. A proper report should include: • a description of the breach;
• the type and volume of data affected; • the number of individuals impacted; • measures taken to contain the breach; and • whether and how the data subjects were notified. Not all data breaches are criminal. However, Law 81 identifies specific circumstances where a breach may be considered a criminal offence or lead to criminal liability: • intentional data collection or misuse (Article 41) – if data is collected or used fraudulently or malicious - ly, it may be classified as a “very serious” violation; • unauthorised international data transfers – transfer- ring personal data across borders without meeting legal requirements can trigger criminal investiga - tions; • failure to suspend data processing after official orders – ignoring directives from ANTAI or other authorities may result in criminal sanctions; and • repetition of serious violations – recurrent breaches may escalate the severity of penalties. In these cases, the breach may be reported to the Public Ministry or relevant criminal investigation authorities. The affected party or ANTAI may initiate legal pro - ceedings, and the courts will determine liability and impose penalties, which may include fines, suspen - sion of operations, or imprisonment, depending on severity. If a data breach appears to involve criminal intent or gross negligence, the following steps should be taken: • document the incident thoroughly – include logs, communications and evidence of unauthorised access; • notify ANTAI immediately – even if the breach is under investigation, ANTAI must be informed;
225 CHAMBERS.COM
Powered by FlippingBook