PanamaLey 81 de 2019, Sobre Protección de Datos Personales
Ley No. 81 de 26 de marzo de 2019 Sobre Protección de Datos Personales, Gaceta Oficial No. 28743-A, arts. 1-4, 6-12, 14, 24-32, 44 and 47 (general provisions, lawful basis and accountability)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Governance, Security, Disclosure, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Have a lawful basis, such as consent, contractual necessity or a legal obligation, before processing a person's personal data, and use it only for the purpose for which it was collected.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P1
- Keep confidential any personal data you access that did not come from a source open to the public, even after your relationship to the processing ends.NIST Privacy FrameworkPR.DS-P5
- Present a clear, distinguishable privacy notice before collecting personal data online, and keep any bundled consent request identifiable from the rest of the terms.NIST Privacy FrameworkCM.AW-P1
- Maintain a registry of every database you disclose to third parties, covering its legal basis, its contents, who receives it, retention periods and everyone who accessed it, and produce that registry to ANTAI on request.NIST Privacy FrameworkCM.AW-P4
- Before disclosing personal data to a requester, identify the requester and the purpose, notify the data subject, and record how long the requester will hold the data and how it will be destroyed, unless the data subject has consented.NIST Privacy FrameworkCM.AW-P4NIST Privacy FrameworkCT.PO-P2
- Do not disclose personal data identifying a person once seven years have passed since your legal duty to retain it ended, unless that data subject asks you to.NIST Privacy FrameworkCT.PO-P2
- Hand over stored personal data to a competent judicial authority only on a properly substantiated request, never in response to a bulk request, and, if you operate a public communications network, maintain the security measures this Law requires to protect it.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Actor identity, Access record, Event time
Logging duty
Article 31 requires a responsible party or database custodian that transfers personal data to third parties to keep a register of those databases, available to the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) whenever it requires it, showing among other things the identity and period of every person who has accessed the personal data. Article 32 requires a record of each request to transfer personal data over a digital network or any other means (the requester, the purpose, the data, the notice to data subjects and the maximum time of use), except for the controller's internal processes. Article 6 allows consent to be obtained in a traceable, documented way but does not require it. No period for keeping the register is stated: the retention time that Article 31 lists is a particular of each database, not a period for the register, and the seven-year bar in Article 28 limits disclosure of data. The cited articles name no territorial test; Article 5 sits in another row.
- Kind
- Explicit
- As of
- Provision
- Articles 31 and 32
- Trigger
- personal_data_processing
What this law does
Article 1 sets the Law's object as the principles, rights, obligations and procedures that govern personal data protection, and lets any natural or legal person, public or private, for profit or not, process personal data provided it does so under the Law and for permitted purposes.
Article 6 conditions any processing of personal data on the data subject's consent, contractual necessity, a legal obligation, or authorization under a special law, requires the person consenting to be duly informed of the purpose, and lets consent be revoked without retroactive effect.
Article 11 confines personal data to the determined, explicit and lawful purposes disclosed when it was collected, and bars any other use absent the data subject's consent, a special law, contractual necessity, or a public entity's legal functions or a judicial order. Article 9 obliges everyone with access to personal data, in public or private organizations, to keep it confidential when it did not come from a source open to the public, an obligation that survives the end of their involvement.
Article 14 makes a database custodian answerable for damages its own lack of due diligence causes. Article 26 requires an operator of a public communications network to adopt technical and management measures that secure its network and services to the standard this Law sets. Article 27 requires an online collector to present an accessible privacy policy or terms of service, set apart from other terms in clear and simple language where consent is bundled with them.
Article 28 bars disclosing or communicating data identifying a person once seven years have passed since the legal duty to retain it ended, unless that data subject expressly asks otherwise.
Article 29 confines a public entity's processing of personal data to matters within its own competence, and article 30 bars a public entity from disclosing a data subject's criminal or disciplinary record once the underlying sanction has lapsed or been served, except to a competent court or another public body bound to the same confidentiality.
Article 24 requires a database custodian to hand stored or transferred personal data to a competent judicial authority on a properly substantiated request, and bars any mass request for personal data outright.
Articles 31 and 32 require a registry of every database disclosed to third parties, naming the database, its legal basis, how it is obtained and treated, its recipients, retention periods and everyone who accessed it, and require a disclosure request itself to identify the requester and purpose, notify the data subject, and state how long the data will be used and how it will be destroyed.
Article 44 extends the Law's rights to personal data already held in a database that existed before the Law took effect. Article 47 sets the Law's entry into force two years after its promulgation, and the Law's Gaceta Oficial publication places that entry into force on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .