PANAMA Law and Practice Contributed by: Rafael Rivera, Malvis Mina, Nicole Pérez and Carolina Lino, BDO Panama
Lawful Bases for Data Processing The processing of personal data shall be deemed lawful if it is based on one of the following legal grounds: • the data subject expresses consent; • processing is necessary for the performance of a contract to which the data subject is a party; • processing is necessary for compliance with a legal obligation to which the data controller is subject; or • processing is authorised by a special law or by regulations issued pursuant thereto. Data Subject Rights (ARCO Rights) Panamanian legislation recognises the following rights of data subjects, commonly referred to as ARCO rights. • Right of Access – to obtain confirmation as to whether personal data concerning them is being processed and to access such data. • Right to Rectification – to request the correc - tion of inaccurate or incomplete data. • Right to Erasure (Cancellation) – to request the deletion of data when it is no longer nec - essary or is being processed unlawfully. • Right to Object – to object to the processing of their data on legitimate grounds. • Right to Data Portability – to receive their per - sonal data in a structured, commonly used, and machine-readable format and to transmit it to another controller. The data controller must ensure that the exercise of these rights is facilitated in a free and easily accessible manner. Depending on the nature of the request, the controller must respond within five to ten business days.
Data Transfers The transfer of personal data, whether domestic or cross-border, is permitted if it is carried out under one of the lawful conditions established by law. These include, among others: • the data subject’s consent; • the recipient country ensures an adequate or higher level of data protection; and • the transfer is made to an entity within the same corporate group as the data controller, provided that the purpose of the processing remains the same. In the case of intra-group transfers, it is essential to implement appropriate safeguards to ensure compliance with data protection regulations. Such measures may include maintaining records of transferred databases, adopting Binding Cor - porate Rules (BCRs), or implementing other enforceable self-regulatory mechanisms. 8.2 Geographical Scope Unlike other jurisdictions, Panamanian data pro - tection regulations apply exclusively to databas - es domiciled within the territory of the Republic of Panama or in cases where the data controller is domiciled in Panamanian territory. However, it is important to note that the protec - tion of personal data is also enshrined at the constitutional level, through the recognition of the right of access to information, the inviola - bility of correspondence, and the constitutional remedy of habeas data. Failure to comply with personal data protec - tion provisions may result in administrative fines ranging from USD1,000 to USD10,000.
630 CHAMBERS.COM
Powered by FlippingBook