GuatemalaLey de Acceso a la Información Pública, Decreto 57-2008 (personal-data provisions)
Decreto Número 57-2008, Ley de Acceso a la Información Pública, arts. 9, 31-32, 61-67
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not disseminate, distribute, or commercialize personal data held in an information system without the data subject's express written consent.
- Never commercialize sensitive personal data (racial or ethnic origin, political ideology, religious belief, health, sexual life, or similarly intimate data) by any means.
- Before commercializing or distributing personal data or sensitive personal data that does not come from a public registry, obtain the titleholder's express written authorization.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 64 (commercializing personal data without authorization) and article 65 (unauthorized alteration or destruction of personal data on file) each carry five to eight years' imprisonment and a fine of fifty thousand to one hundred thousand quetzales, plus forfeiture of the instruments of the offense under article 64.
Penalty structure
Fine range under art. 64 (comercialización de datos personales); art. 65 (alteración o destrucción de información) carries the identical range. Both are companion to imprisonment of five to eight years.
- Rule
- Fixed only
- As of
- Minimum
- 50,000
- Currency
- GTQ
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Procurador de los Derechos Humanos (Human Rights Ombudsman), the designated supervisory authority under this law; criminal prosecution proceeds through the ordinary Ministerio Público
Settledness
- As of
- Open questions
- Does a private company that manages public resources only under a contract with the State count as a 'sujeto obligado' under Article 6 of Decreto 57-2008, so that the consent rule of Article 31 binds it?
What it reaches
Obligation class
Consent, Disclosure, Data subject rights
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- The holder is a sujeto obligado under Article 6: any natural or legal person, public or private, national or international, that manages, administers or executes public resources, State property or acts of public administration in general (the consent rule of Article 31 binds obligated entities).
What it makes you log
Logging duty
The cited articles define personal and sensitive data (Article 9), bar an obligated entity from disseminating or commercializing personal data without the data subject's express written consent and bar commercializing sensitive data (Article 31), list the exceptions (Article 32) and punish commercializing or distributing personal data without written authorization and altering or destroying personal data held in public files (Articles 64 and 65). A consent that must be given in writing is a condition of disclosure; the Decreto does not say the entity must keep or show a record of it, and the criminal rules name no log. Articles 33 and 34, which let the data subject obtain the data held and a written resolution recording a modification, are not among the articles this row cites. No audit and no party who may demand a record is named. Article 31 binds obligated entities and states no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Decreto 57-2008 is principally a freedom-of-information statute, but article 9 defines datos personales as any information concerning an identified or identifiable natural person and datos sensibles as data touching a person's racial or ethnic origin, political ideology, religious belief, health, sexual life, or other intimate matters.
Article 31 bars an obligated entity from disseminating, distributing, or commercializing personal data held in its information systems without the data subject's express written consent, and expressly and absolutely prohibits commercializing sensitive data by any means.
Article 32 lists narrow exceptions to the consent requirement, including statistical, scientific, or general-interest purposes where the data cannot be linked back to the individual, and transmission between obligated public entities for the exercise of their duties.
Article 64 makes it a crime, punishable by five to eight years' imprisonment and a fine of fifty thousand to one hundred thousand quetzales, for anyone to commercialize or distribute personal data or sensitive personal data protected by the law without the titleholder's express written authorization, where the data does not come from public registries, without prejudice to civil liability for resulting damages.
Article 65 similarly punishes unauthorized alteration or destruction of personal data held in a public institution's files or electronic records with the same penalty range.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .