Argentina: Submitted Personal Data Protection Bill including cross-border data transfer regulation to Congress

On 29 June 2023, the Argentinian data protection agency (AAIP) submitted its definitive draft for a Personal Data Protection Bill amending the current Personal Data Protection Act No. 25.326, to the Argentinian Congress. The draft Bill is the result of a process of participatory drafting of standards. The transfers would be allowed to jurisdictions and organizations that provide an adequate level of protection or the data exporter provides adequate safeguards for the processing of personal data in compliance with the minimum and sufficient conditions established by the Bill. The adequate safeguards can be provided through legally binding and enforceable instruments between public authorities of Argentina and other countries, a bilateral or multilateral international agreement between Argentina and other countries, agreements or conventions that recognize the principles, rights, and obligations established by the Bill and approved by AAIP, such as model contractual clauses, binding corporate rules and data protection certification mechanisms. Finally, the Bill outlines exceptions, specifying that transfers can be made if the data subject has given its consent, the transfer is necessary for the performance of a contract between the data subject and the data controller or the transfer is necessary for the public interest, a judicial proceeding, protect the life of the data subject or other individuals. The transfers outlined in the exceptions would have to comply with international human rights standards, the principles of legality, proportionality, and necessity. The exceptions cannot be used for international transfers on a periodic or regular basis and cannot involve a large number of individuals' personal data.