ArgentinaLey 25.326, personal data reached by scraping
Ley 25.326, Ley de Protección de los Datos Personales, arts. 2 and 5
In force.
A personal data rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Scraping personal data from a public source excuses obtaining the data subject's consent, but does not excuse registering the resulting file or database, keeping the data accurate and secure, or observing the cross-border transfer restriction.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 5(1) makes processing of personal data unlawful without the data subject's free, express and informed consent, which must be set down in writing or by an equivalent means, so a person relying on consent must hold a record of it. Article 5(2)(a) removes the consent requirement for data obtained from sources of unrestricted public access, which is the case scraping rests on, and that exception leaves nothing for a scraper to record under article 5. The Law's file registration and security provisions are outside the articles the row cites.
- Kind
- Implicit
- As of
- Provision
- Ley 25.326, art. 5(1): consent to the processing of personal data must be set down in writing or by an equivalent means.
- Trigger
- consent_or_optout
- personal_data_processing
What this law does
Ley 25.326 defines personal data as information of any kind referring to identified or identifiable individuals or corporations, without excluding information that is publicly accessible, so scraping personal data from a public Argentine website does not by itself remove the data from the Act's coverage.
Article 5.2.a excuses the consent requirement specifically where the data is obtained from an unrestricted public-access source, but that exception is textually confined to consent, leaving the Act's other duties, registration of the resulting file or database, data quality, security, and the cross-border transfer restriction in article 12, applicable to a scraper that becomes the person in charge of, or user of, a database intended to provide reports.
Ley 25.326 was passed on and partially promulgated on . It was published in the Boletín Oficial on . The Law ends with an order to communicate it to the Executive and states no day of its own for its entry into force. Article 2 of the Código Civil then in force, as substituted by Ley 16.504, made a law that designates no time binding after the eight days following its official publication. No source located states the day on which the Law became binding.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .