Consent is Required for Personal Data Transfer

In re “Torres Abad, Carmen c/ EN-JGM s/Habeas Data” the plaintiff filed a summary proceeding aiming at preserving the protection of the information provided to the Argentine Social Security Authority ( the ANSES after its Spanish acronym) and preventing the use of her personal data for different purposes than those for which it was collected. The claim is motivated by Resolution No. 166-E/2016 issued by the Chief Cabinet’s Office (Resolution) which approved the Agreement between the ANSES and the Argentine Public Communication Secretary’s Office. This agreement entails the regular and periodical transfer to such Public Communication Secretary’s Office of affiliates’ personal data including a) name and surname; b) ID No. ; c) tax ID No.; d) address; e) telephone No.; f) email address; g) date of birth; h) marital status; and i) education.

The lawsuit was rejected by the Lower Court Judge which led to the appeal filed by the plaintiff.

The plaintiff stated that certain information transferred according to the Resolution is not covered by the exception to the consent rule of section 5 of Personal Data Protection Law No. 25,326 (hereinafter “PDPL”). The discussion in this case was focused particularly on the telephone number and email address as they are not specifically included in such exception.

The Court decided that for the personal data transfer to be valid, prior consent from the data subject is required. Based on this, the Court ordered the ANSES to refrain from processing the email address and telephone number.

To rule in that way, the Court considered that the exceptions of section 5 of the PDPL must be construed restrictively since the general rule for data processing is the need to obtain explicit consent from the relevant data subject.

As to the exception for the need of the explicit consent when data is collected for public activities or according to a legal obligation (as stated in section 5, subsection 2 b) of the PDPL), the Court determined the following: (i) that the aim of the data transfer must be related to national defense, public security or crime control purposes, which is not the case; and (ii) that the lack of consent cannot be alleged on the basis of a legal obligation since the reference to a purpose on an administrative resolution cannot constitute a valid exception to the right to privacy protection set forth by the PDPL. In that sense, the authority to transfer personal data within different state entities without the data subject consent must be interpreted restrictively to prevent the violation of the right to informational self-determination of each data subject pursuant to sections 43, third paragraph and 19 of the Argentine Constitution.

The Court concluded that the data transfer to the Public Communication Secretary´s Office has a different purpose from the one that caused the collection of such data by the ANSES. For this reason, explicit consent for the processing activities of her personal data including the telephone number and email address must be obtained from the plaintiff.