CDDBMs and personal data protection in Brazil, Chile, Colombia, and Mexico: the common experience.

• Pages: 157-189
• Author: Vivian Newman-Pont,Daniel Ospina-Celis,Juan Carlos Upegui

157

Working Paper 10

CDDBMs AND PERSONAL DATA PROTECTION

IN BRAZIL, CHILE, COLOMBIA, AND

MEXICO: THE COMMON EXPERIENCE

Daniel Ospina-Celis

Juan Carlos Upegui

In this chapter, we present an analytical and comparative overview of

how some CDDBMs collect and process personal data in Brazil, Chile,

Colombia, and Mexico. is exercise is possible thanks to the country re-

ports included in this book. According to the methodology described in

the introduction of each chapter, the reports were prepared based on an

analysis of the privacy policies of the products oered by various companies

and their relationship with the Internet giants (GAFAM). As a comparative

exercise—and by highlighting the common ndings—this chapter intends

to account for the challenges that the advances of the digital era pose to the

rights to the protection of private life and personal data in the region.

At the same time, this comparative report is a reection on the cur-

rent dynamics of the digital age and their impact on fundamental rights, a

brief exercise in comparative law—in terms of local legislation on personal

data protection—and a modest contribution to the literature on the rela-

tionship between business and human rights178 in digital environments.

178. Developing this idea, the United Nations Human Rights Council adopted

the Guiding Principles on Business and Human Rights: United Nations

General Assembly, Resolution A/HRC/RES/17/4, “Human Rights and

Transnational Corporations and Other Business Enterprises,” July 6, 2011.

https://undocs.org/en/A/HRC/RES/17/4. The Guiding Principles on Busi-

ness and Human Rights are contained in United Nations, HR/PUB/11/04,

2011, “Implementing the United Nations ‘Protect, Respect and Remedy’

Framework.” New York and Geneva: United Nations. https://www.ohchr.

org/documents/publications/guidingprinciplesbusinesshr_sp.pdf

BACK TO TOC

158 Data Feast: Enterprises and Personal Data in Latin America

e right to the protection of personal data is a human right derived

from the right to privacy. In the global context, the right to the protection

of privacy was recognized under Article12 of the Universal Declaration

of Human Rights179 and Article17 of the International Covenant on Civil

and Political Rights.180 Interpreting these provisions, the Human Rights

Commiee mentioned that “every individual should have the right to

ascertain in an intelligible form, whether, and if so, what personal data

is stored in automatic data les, and for what purposes.”181 In 2016, the

United Nations General Assembly adopted Resolution A/C.3/71/L.39

on the right to privacy in the digital age, which calls upon all States and

business enterprises to meet their responsibility of respecting human

rights, including the right to privacy in the digital age.182

In the European context, the right to the protection of personal data

was the subject of the Council of Europe Convention108 of 1981, the

rst international instrument whose purpose was to safeguard every indi-

vidual’s “right to privacy, with regard to automatic processing of personal

data relating to him.”183 Similarly, it was recognized as an autonomous

fundamental right under Article8.1 of the European Union Charter of

Fundamental Rights, adopted in 2000—and binding since 2009—as the

right of every individual “to the protection of personal data concerning

him or her.”184 In turn, in the context of the European community law,

in 1995, it adopted Directive95/46/CE of the European Parliament and

of the Council, which extensively regulated the “protection of persons

179. United Nations General Assembly, “Universal Declaration of Human

Rights,” Paris, 1948. https://www.un.org/en/universal-declaration-hu-

man-rights/

180. United Nations General Assembly, “International Covenant on Civil and

Political Rights,” New York, 1966. https://www.ohchr.org/SP/Profession-

alInterest/Pages/CCPR.aspx

181. Human Rights Committee, General Comment No. 16 of 1988, General

Comments Adopted by the Human Rights Committee, Article 17. 1988.

https://undocs.org/en/HRI/GEN/1/Rev.7

182. United Nations General Assembly, Resolution A/C.3/71/L.39, “The Right

to Privacy in the Digital Age.” October 31, 2016. https://www.ohchr.org/

en/issues/digitalage/pages/digitalageindex.aspx

183. Council of Europe, Convention 108 of 1981, “Convention for the Protec-

tion of Individuals with regard to Automatic Processing of Personal Data.

January 28, 1981. https://rm.coe.int/16806c1abd

184. European Union, “Charter of the Fundamental Rights of the European

Union.” Ofcial Journal of the European Communities, C 364/1. December

18, 2000. https://www.europarl.europa.eu/charter/pdf/text_es.pdf

159

Working Paper 10

with regard to the processing of personal data.”185 Recently, this directive

was revoked by the new General Data Protection Regulation, Regulation

(EU) 2016/79, which updated the personal data protection regime to

bring it in line with the new practices of the digital economy.186

In the Latin American sphere, there is still no binding international

instrument that recognizes and regulates the right to personal data protec-

tion. However, it has been recognized in so law instruments, such as the

Declaration of Santa Cruz de laSierra,187 adopted in 2003 at the end of an

Ibero-American summit of Heads of State which, in numeral 45, recog-

nizes the protection of personal data as a “fundamental right of people.”

Furthermore, in 2017, the Ibero-American Data Protection Network

passed the “Standards for Data Protection for the Ibero-American States,”

recognizing the protection of personal data as a fundamental human right

(recital1), especially relevant in the digital age.188

Parallel to the developments on the right to the protection of pri-

vacy at a global and regional level, the legal systems of the countries un-

der analysis have constitutionally and legally recognized the right to data

protection. In Brazil, the right to habeas data is recognized under num-

ber71 of Article5 of the 1988 Constitution.189 Specically, it safeguards a

procedural mechanism to know the information regarding an individual

contained in public databases and for data rectication. Law 13.709 of

185. European Parliament and Council, Directive 95/46, “On the Protection

of Natural Persons with Regard to the Processing of Personal Data and

on the Free Movement of Such Data.” October 24, 1995. https://eur-lex.

europa.eu/legal-content/ES/TXT/HTML/?uri=CELEX:31995L0046&from

=EN

186. European Union, General Data Protection Regulation (GDPR). Europe-

an Parliament and Council Regulation EU 2016/679, “On the Protection

of Natural Persons with Regard to the Processing of Personal Data and

on the Free Movement of Such Data, and Repealing Directive 95/46/

EC.” April 27, 2016. https://eur-lex.europa.eu/legal-content/ES/

TXT/?uri=CELEX%3A32016R0679

187. Organization of American States, “Declaration of Santa Cruz de la Sierra,”

Andean Presidential Council, January 30, 2003. https://www.segib.org/

wp-content/uploads/DeclaraciondeSantaCruz.pdf

188. Ibero-American Data Protection Network, “Standards for Data Protection

for the Ibero-American States,” June 20, 2017. https://iapp.org/media/

pdf/resource_center/Ibero-Am_standards.pdf

189. Constitution of the Federative Republic of Brazil, October 5, 1988. https://

www.acnur.org/leadmin/Documentos/BDL/2001/0507.pdf