Makes credit decisions, in Argentina

Ley 25.326, Ley de Protección de los Datos Personales (2000), arts. 1-5, 9-11, 21-28, 47 (general regime, data quality, security, confidentiality, disclosure, registration, and sector rules) · Read the law's page

• Obtain the data subject's free, express, and informed consent before processing their personal data, unless it comes from an unrestricted public-access source, is needed for a State function or legal obligation, is limited to a short listing of name and identifying numbers, arises from a contractual, scientific, or professional relationship, or is financial-entity customer data covered by Ley 21.526.
• Collect only personal data that is true, adequate, relevant, and not excessive for the purpose you obtained it, use it only for that purpose, keep it accurate and updated, correct or delete it once you learn it is inaccurate or incomplete, store it so the data subject's access right can be exercised, and destroy it once it is no longer necessary.
• Adopt the technical and organizational measures needed to guarantee the security and confidentiality of personal data and to detect unauthorized or accidental deviations, and do not register personal data in a file that lacks adequate technical integrity and security conditions.
• Keep personal data confidential during and after your involvement in processing it, and disclose it to a third party only for a purpose tied to both parties' legitimate interest and with the data subject's prior, revocable, informed consent naming the purpose and the recipient, unless a listed exception applies.
• Register any database intended to provide reports, public or private, with the National Registry before operating it, stating your identity, the file's purpose, its data sources, recipients, security measures, retention period, and how a data subject can exercise their rights, and do not hold data of a kind you did not declare.
• As a public body, create, modify, or suppress a database only through a general disposition published in the Official Gazette that states the file's characteristics and purpose, how data is obtained and updated, and where a data subject can exercise their rights.for a public body
• As a military, security, police, or intelligence body, limit consent-free processing of personal data for defense or public-security purposes to what your legally assigned mission strictly requires, keep the resulting files specific and classified by reliability, and cancel police-purpose data once it is no longer needed for the inquiry that justified it.when it serves a public body
• As a data-processing service provider acting for another party, use the personal data only for the purpose stated in the service contract, do not disclose it to others, and destroy it once the contracted service ends unless further engagements are reasonably expected, in which case you may keep it securely for up to two years.
• As a credit-information service, process only patrimonial solvency and credit data from public sources or the data subject's own information or consent and payment-default data the creditor furnishes, keep it no longer than five years significant to evaluating solvency (two years once the debt is cancelled or extinguished), and disclose to the data subject on request what was reported about them in the last six months.
• Build an advertising, direct-marketing, or profiling database only from sources accessible to the public or furnished by, or with the consent of, the data subject.
• Treat opinion-poll, market-research, or scientific-research data as outside this Act only while it cannot be attributed to an identifiable person, and apply a dissociation technique where anonymity cannot otherwise be kept during collection.
• If you operate a credit-reporting database, purge and stop recording any delinquency or Central Bank risk-category 2 to 5 entry tied to an obligation that fell due between January 1, 2000 and December 10, 2003 once the debt is cancelled or regularized, and tell any database you disclosed the original default to about the cancellation.

Ley 25.326, arts. 6, 13-16, 19, 27.3 (data subject rights) · Read the law's page

• Before collecting a data subject's personal data, tell them in clear, express terms the purpose it will be processed for and who may receive it, that a file or database exists together with its controller's identity and address, whether answering is mandatory or optional, the consequences of answering, refusing, or answering inaccurately, and that they may exercise access, rectification, and erasure rights.
• Let a data subject query the control body's public, free registry to learn what personal-data files exist, their purposes, and their controllers' identity.
• On a verified-identity request, give the data subject their personal data from a public or private reporting database within ten running days, free of charge at intervals no shorter than six months absent a legitimate interest, in clear language without codes, covering the whole record without revealing a third party's data, in the medium the data subject chooses.
• Rectify, update, or, where appropriate, delete or restrict a data subject's inaccurate, incomplete, or outdated personal data within five business days of the claim or of learning of the error, and notify any recipient the data were disclosed to within five business days, unless erasure would harm a third party's legitimate rights or a legal duty requires retention.
• Provide rectification, updating, or erasure of inaccurate or incomplete personal data free of charge, and mark a record as under review while you verify its accuracy.
• Let a data subject request the removal or blocking of their name from an advertising, direct-marketing, or profiling database at any time.

Agencia de Acceso a la Información Pública, Resolución 4/2019, Anexo I, Criterio 2 (tratamiento automatizado de datos) · Read the law's page

• It binds every database controller covered by Ley 25.326 where you take decisions based solely on automated processing of data that produce adverse legal effects for the data subject or significantly and negatively affect them (Criterio 2 and article 1 of the resolution).
• On a data subject's request, explain to them the logic applied in a decision you took solely by automated processing of their data that produced adverse legal effects for them or significantly and negatively affected them.

Agencia de Acceso a la Información Pública, Resolución 161/2023, published Official Gazette 4 September 2023

• Document automated decision-making systems on the public Transparency Portal.

Decreto 1558/2001, art. 27 (reglamentación de la Ley 25.326: bases de datos con fines de publicidad, retiro o bloqueo) · Read the law's page

• State in every advertising message sent by mail, telephone, email, the Internet or another distance medium, expressly and prominently, that the recipient may ask to be removed or blocked, in whole or in part, from your database.
• Honor a request for total or partial withdrawal by blocking, at the data subject's request, only the media they name, such as mail, telephone or email.
• On the data subject's request, tell them the name of the controller or user of the data bank that supplied their information.

Expediente 3003-D-2024 (Cámara de Diputados de la Nación Argentina), introduced 10 June 2024

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Do not deploy an AI system that poses an unacceptable risk.
• Conduct a Human Rights Impact Assessment for AI systems.
• Meet transparency and disclosure obligations for AI systems.

Expediente 4243-D-2025 (Cámara de Diputados de la Nación Argentina), introduced 7 August 2025

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Register medium and high-risk AI systems in the National Registry of Artificial Intelligence Systems.
• Disclose the AI system's purpose, logic, level of automation, and use of data.