Processes personal data, in Panama

Ley 81 de 2019, arts. 15-18 and 21-23 (rights of data subjects) · Read the law's page

• Let a data subject access their personal data held in your databases, free of charge, and tell them its origin and purpose.
• Correct, cancel, or stop processing a data subject's personal data on request when it is incorrect, irrelevant, incomplete, outdated, inaccurate or false, and let them revoke consent.
• Give a data subject a structured, commonly used, machine readable copy of their personal data on request, transferable to another responsible party, at least where they supplied the data directly, a relevant volume of automated processing is involved, or they consented or a contract requires it.
• Answer an access request within ten business days free of charge, and complete a correction, blocking, or deletion within five business days of the request.
• Do not limit a data subject's access, rectification, cancellation, opposition or blocking rights by contract or agreement of any kind; a clause that tries is void.
• Let a data subject reach any one of several responsible parties that feed a shared database, and extend these rights to personal data you held before the Law took effect.

Ley 81 de 2019, arts. 2(5) and 26 (duty to notify security breaches) · Read the law's page

• Notify the affected data subject as soon as possible after learning that their personal data was stolen without authorization or that its security was otherwise compromised. This Law sets no fixed number of hours or days for that notice and no duty to notify ANTAI of the breach.
• As an operator of a public communications network, tell affected data subjects about a particular breach of your network's security and the measures you are taking, again with no fixed period stated.

Ley 81 de 2019, arts. 34-37 and 38-46 (enforcement, sanctions and offences) · Read the law's page

• Expect ANTAI to investigate a complaint against you and to impose a graduated administrative fine of B/.1,000 to B/.10,000 depending on whether the infraction is minor, serious or very serious, with a very serious infraction also risking closure of your database registries or suspension of your processing activity.
• Cooperate with ANTAI's information requests and inspections and respond to its formal notices and observations; failing to do so is itself a serious infraction.
• Pay any patrimonial or moral damage your unlawful processing of personal data causes, which a data subject may pursue in the ordinary courts on top of ANTAI's administrative sanction.
• Expect a repeat of the same infraction within three years to be treated as recidivism, and document every sanctioned fact so ANTAI can weigh its gravity, repetition or recidivism.

Ley 81 de 2019, arts. 4(11), 8, 13 and 20 (sensitive personal data) · Read the law's page

• Do not transfer sensitive personal data (data touching a person's intimate sphere, or whose misuse could enable discrimination or serious risk, including racial or ethnic origin, religious or philosophical belief, union affiliation, political opinion, health, sexual orientation, or genetic or biometric data) unless the data subject gave explicit authorization or a narrow statutory exception applies.
• Take a data subject's consent to processing sensitive health data only when it is prior, irrefutable and express, a higher bar than ordinary consent.
• Process a patient's health data, as a health establishment or medical professional, only within your own care of that patient, and keep it confidential under professional secrecy.

Ley 81 de 2019, arts. 5 and 33 (cross border transfer of personal data) · Read the law's page

• Before storing or transferring personal data domiciled in Panama across a border, confirm you meet this Law's data protection standards, or standards equal to or higher than them, unless the data subject consented, a contract requires it, it is a banking or securities transfer, or a ratified international treaty compels it.
• Before an international transfer of personal data, confirm at least one lawful ground applies, among them the data subject's consent, an equivalent or superior protection level in the receiving country, a ratified treaty, medical necessity, transfer within the same corporate group, a contract, a public interest or legal defense need, judicial cooperation, a banking or securities transaction, international intelligence cooperation, a binding self-regulation mechanism, or contractual clauses meeting this Law's protections.
• Remain responsible, as the party transferring or receiving personal data internationally, for the lawfulness of the processing you send or take in.

Ley No. 81 de 26 de marzo de 2019, Sobre Protección de Datos Personales, Gaceta Oficial No. 28743-A, arts. 1-4, 6-12, 14, 24-32, 44 and 47 (general provisions, lawful basis and accountability) · Read the law's page

• Have a lawful basis, such as consent, contractual necessity or a legal obligation, before processing a person's personal data, and use it only for the purpose for which it was collected.
• Keep confidential any personal data you access that did not come from a source open to the public, even after your relationship to the processing ends.
• Present a clear, distinguishable privacy notice before collecting personal data online, and keep any bundled consent request identifiable from the rest of the terms.
• Maintain a registry of every database you disclose to third parties, covering its legal basis, its contents, who receives it, retention periods and everyone who accessed it, and produce that registry to ANTAI on request.
• Before disclosing personal data to a requester, identify the requester and the purpose, notify the data subject, and record how long the requester will hold the data and how it will be destroyed, unless the data subject has consented.
• Do not disclose personal data identifying a person once seven years have passed since your legal duty to retain it ended, unless that data subject asks you to.
• Hand over stored personal data to a competent judicial authority only on a properly substantiated request, never in response to a bulk request, and, if you operate a public communications network, maintain the security measures this Law requires to protect it.