Does HR data processing require registration under data protection laws?
Data protection laws sometimes include conformity assessments, which help to ensure businesses follow regulations. Requirements can include registration before the Data Protection Authority and random audits.
Argentina’s Protection of Personal Data Law No. 25326 sets the requirement that public and private registries and databases which are intended provide reports must be registered with the National Registry of Personal Databases (Note: this excludes databases for home use). Employers processing HR related data are included in this requirement.
The information provided to the registration authority must include:
- the name and address of the person responsible for the database;
- the characteristics and purpose of the database;
- the nature of the personal data in each file;
- the method(s) used to collect and update the data;
- the destination of the data that’s collected and who may receive the data;
- how different registered information is related;
- how the data is secured, including the category of individuals who may access and process the information;
- the data retention period; and,
- how individuals can access data relating to them and the procedures they must follow to have their data corrected or updated.
Digital images and videos must also be registered (Provision 10/2015). The registration should include a data protection manual or policy with:
- information on the form of the personal data collection;
- reference of the place(s), dates and times they are expected to operate;
- the retention period;
- technical security and data protection measures that are being taken;
- measures that are being taken to ensure that the rights of employees (and other data owners); and,
- the justification of taking photographs to enter the property as security measure, if applicable.