PanamaLey 81 de 2019, enforcement and sanctions
Ley 81 de 2019, arts. 34-37 and 38-46 (enforcement, sanctions and offences)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect ANTAI to investigate a complaint against you and to impose a graduated administrative fine of B/.1,000 to B/.10,000 depending on whether the infraction is minor, serious or very serious, with a very serious infraction also risking closure of your database registries or suspension of your processing activity.
- Cooperate with ANTAI's information requests and inspections and respond to its formal notices and observations; failing to do so is itself a serious infraction.
- Pay any patrimonial or moral damage your unlawful processing of personal data causes, which a data subject may pursue in the ordinary courts on top of ANTAI's administrative sanction.
- Expect a repeat of the same infraction within three years to be treated as recidivism, and document every sanctioned fact so ANTAI can weigh its gravity, repetition or recidivism.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Administrative fine per infraction, graduated by ANTAI according to the infraction's gravity (leve, grave, muy grave); a very grave infraction may also carry closure of the database's registries or suspension of the processing activity.
- Rule
- Fixed only
- As of
- Minimum
- 1,000
- Currency
- PAB
- Fixed cap
- 10,000
Who enforces it
Enforcement body
Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI)
Settledness
- As of
- Open questions
- Do the amounts of B/.1 000.00 to B/.10 000.00 that ANTAI fixes under Article 36 apply to each infraction or to each sanction proceeding?
- Does the claim for damages for "tratamiento indebido" under Article 37 require a prior ANTAI finding of infringement before the courts hear it?
What it makes you log
Logging duty
Articles 34 to 46 create the Consejo de Protección de Datos Personales, give ANTAI its sanctioning power and classify the infractions. Article 40(7) and (8) make it a serious infraction to withhold documentation or information ANTAI formally requests or to obstruct its inspection, a power to demand information and not a duty to keep a record. The last paragraph of article 43 has ANTAI document the facts that bring a sanction, a duty of the authority and not of the responsible party. The register of transfers in Article 31 sits in an article the row does not cite.
- Kind
- None
- As of
What this law does
Article 34 creates the Consejo de Protección de Datos Personales as a consultative body drawing members from government ministries, regulators, the private sector, the bar and the banking industry, and article 35 gives it the power to advise the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI), recommend public policy, and evaluate submitted cases.
Article 36 empowers ANTAI to sanction a responsible party or database custodian found, on investigation of a complaint, to have infringed a data subject's rights, sets fines from B/.1,000 to B/.10,000 graduated by the infraction's gravity, and allows reconsideration before ANTAI's own Dirección and appeal to its director general.
Article 37 lets a data subject sue a responsible party in the ordinary courts for patrimonial or moral damage its unlawful processing caused, independent of ANTAI's administrative sanction.
Articles 38 to 41 classify infractions as minor, serious or very serious, minor being a late report to ANTAI, serious spanning consent failures, principle violations, breach of confidentiality, obstructing a data subject's rights, or failing to secure stored data, and very serious spanning bad faith collection, violating the sensitive data rules, ignoring an ANTAI suspension order, an unlawful international transfer, or repeating a serious infraction.
Article 43 sanctions a minor infraction with a citation, a serious infraction with a proportionate fine, and a very serious infraction with closure of the database's registries or suspension of the processing activity in addition to a fine, treats repetition of the same infraction within three years as recidivism, and requires every sanctioned fact to be documented so ANTAI can weigh gravity, repetition or recidivism.
Articles 45 and 46 give ANTAI its own budget line to carry out the Law and task the Órgano Ejecutivo with regulating the Law in coordination with ANTAI.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .