SECURITY REPORTS

Latin America May Follow European Privacy Lead

Wayne Madsen

T he coming into force of the European Data Privacy Directive on October 25, 1998 may

provide the impetus for Latin American nations to adopt European-style data protection laws. Latin American countries first showed real interest in data protection at the International Data Protection Commissioners' meeting in Brussels in 1997 where representatives of Uruguay and Mexico attended as official observers. Latin American delegations turned up again at the 1998 Data Protection Commissioners conference held in Santiago de Compostela, Spain.

Spain and Portugal hope to convince Latin American nations to adopt data protection laws modelled on those in Europe. Moreover, Italy's strong data protection law has won some admirers in Latin America. Versions of the Italian law have been submitted as draft legislation in the congresses of Argentina and Brazil. If Latin American countries adopt similar legislation, the United States could not only find itself faced with a possible cut-off in personal data flows from Europe but from south of its border as well. Some Latin American nations, beset with pressure from Washington on a number of money laundering and data confidentiali ty issues, would welcome the opportunity to use European-style data protection laws to block the flow of personal data to the United States. In addition, Latin American nations do not want to find themselves in the same position as the United States and find themselves blocked from receiving personal data from Europe.

There are strong financial, commercial, and social links between Latin American and European nations. On the other hand, the Latin American countries are under a great deal of pressure from the United States not to follow the European model. The United States uses the prospect of Latin American inclusion in an expanded North Amer ican Free Trade Agreemen t as a deterrent . Additionally, the US-based and influential Direct Marketing Association has stepped up pressure on Latin American govemments not to adopt data protection laws.

Data protection legislation has seen the most progress in the 'ABC countries' of Argentina, Brazil,

and Chile. The Argentine National Congress approved a data protection law in December 1996. It provides for "full protection of personal information recorded in data files, registers, banks or other electronic or manual technical means of data treatment, in order to guarantee the honour and privacy of persons, as well as the access to the information that may be recorded about such persons." It also provides for prior data subject consent and notification, data security, proper uses, types of data that may be ma in ta ined , confidentiality of sensitive personal information, and transborder data flows of personal data. A bicameral congressional Commission on Data Protection was to be established to enforce the law. However, the Central Bank, possibly under pressure f rom Washington ensured that President Carlos Menem vetoed the legislation. There are efforts underway to reintroduce the legislation.

A bill to bring Brazil into accord with the 1980 OECD guidelines on data privacy was proposed in the Senate in 1996 but never made it to the floor for a final vote. The bill, which would cover both the public and private sectors states that, "no personal data nor information shall be disclosed, communicated, or transmitted for purposes different than those that led to structuring such data registry or database, without express authorization of the owner, except in case of a cour t order, and for purposes of a c r imina l investigation or legal proceedings. It is forbidden to gather, register, archive, process, and transmit personal data referring to: ethnic origin, political or religious beliefs, physical or mental health, sexual life, police or penal records , fami ly issues, excep t fami ly relationship, civil status, and marriage system. Every citizen is entitled to, without any charge, access his/her personal data, stored in data registries or databases, and correct, supplement, or eliminate such data, and be informed by data registry or database managers of the existence of data regarding his/her person."

In Chile, a privacy bill was introduced in the House of Deputies in 1996. As with the Brazilian bill, the proposal covers the public and private sectors. Information can only be collected if it is authorized by law or with the express consent of the data subject, who must be informed about the purpose for holding the data. Data subjects have a right of access and can demand corrections or removal of information.

10 Computer Fraud & Security December 1998 3723/98/$19.00 © 1998 Elsevier Science Ltd. All rights reserved