Are there any restrictions on transferring personal data and how can these be overcome?
Cross-border data transfers affect all organizations that engage online IT services, cloud-based services, remote access services and global HR databases. Understanding the applications of lawful data transfer mechanisms is essential to validate recipients located in other nations. Data transfers typically include the following examples:
- personal data communicated over the telephone, by email, fax, letter, through a web tool or in person to another country;
- IT systems or data feeds which lead to personal data being stored on databases hosted outside the country;
- people/entities outside the country being able to access or "see" personal data held in the country; and
- the use of personal data by third parties through external solutions, e.g., outsourcing, offshoring and cloud computing.
Argentina’s Protection of Personal Data Law No. 25326 and the related Protection of Personal Data Decree 1558/2001 allow the international transfer of data in certain circumstances, including when the country the personal data is being transferred to is deemed “adequate” by Argentina’s data protection authority and when the employee's (or other data subject’s) express consent has been obtained.
In 2016, Argentina implemented Provision 60-E/2016, which also allows personal data to be transferred to third countries when the employer adopts standard contractual clauses, as outlined by the European Union Commission. This applies to all employers, including those based outside of Argentina and the European Union. These contractual clauses must provide safeguards that ensure at least a similar level of protection as those under Argentina’s Protection of Personal Data Law.
More recently, Resolution No 159/2018 also allows companies to adopt Binding Corporate Rules, which are strict rules that companies, their subsidiaries and 3rd parties must follow when processing personal data held by the companies. Companies must submit their Binding Corporate Rules for approval to the Agency for Access to Public Information within 30 days of transferring personal information.
There are a few additional circumstances where international data transfers are permitted, but these are unlikely to apply to employers.
HR Best Practices: The use of applications in the cloud frequently results in the international transfer of employee data. Before transferring employee personal data from Argentina to another country, consider whether standard contractual clauses or binding corporate rules should be implemented.