Panama

Article 2(5), among the Law's general principles, requires a responsible party to inform the data subject as soon as possible when their personal data has been stolen without authorization or there is sufficient indication that its security has been compromised, alongside the technical and organizational measures the same principle requires to protect data under the responsible party's custody.

The Law fixes no number of hours or days for that notice, and states no parallel duty to notify the Autoridad Nacional de Transparencia y Acceso a la Información of a breach. Article 26 carries a sector specific duty for an operator of a public communications network, requiring it to tell affected data subjects about a particular breach of its network's security and the measures it is taking, again with no fixed period and no notice to a supervisory authority stated.

Article 1 sets the Law's object as the principles, rights, obligations and procedures that govern personal data protection, and lets any natural or legal person, public or private, for profit or not, process personal data provided it does so under the Law and for permitted purposes.

Article 6 conditions any processing of personal data on the data subject's consent, contractual necessity, a legal obligation, or authorization under a special law, requires the person consenting to be duly informed of the purpose, and lets consent be revoked without retroactive effect.

Article 11 confines personal data to the determined, explicit and lawful purposes disclosed when it was collected, and bars any other use absent the data subject's consent, a special law, contractual necessity, or a public entity's legal functions or a judicial order. Article 9 obliges everyone with access to personal data, in public or private organizations, to keep it confidential when it did not come from a source open to the public, an obligation that survives the end of their involvement.

Article 14 makes a database custodian answerable for damages its own lack of due diligence causes. Article 26 requires an operator of a public communications network to adopt technical and management measures that secure its network and services to the standard this Law sets. Article 27 requires an online collector to present an accessible privacy policy or terms of service, set apart from other terms in clear and simple language where consent is bundled with them.

Article 28 bars disclosing or communicating data identifying a person once seven years have passed since the legal duty to retain it ended, unless that data subject expressly asks otherwise.

Article 29 confines a public entity's processing of personal data to matters within its own competence, and article 30 bars a public entity from disclosing a data subject's criminal or disciplinary record once the underlying sanction has lapsed or been served, except to a competent court or another public body bound to the same confidentiality.

Article 24 requires a database custodian to hand stored or transferred personal data to a competent judicial authority on a properly substantiated request, and bars any mass request for personal data outright.

Articles 31 and 32 require a registry of every database disclosed to third parties, naming the database, its legal basis, how it is obtained and treated, its recipients, retention periods and everyone who accessed it, and require a disclosure request itself to identify the requester and purpose, notify the data subject, and state how long the data will be used and how it will be destroyed.

Article 44 extends the Law's rights to personal data already held in a database that existed before the Law took effect. Article 47 sets the Law's entry into force two years after its promulgation, and the Law's 29 March 2019 Gaceta Oficial publication places that entry into force on 29 March 2021.

Article 5 subjects a database located in Panama, or whose responsible party is domiciled there, to this Law, and permits storing or transferring confidential, sensitive or restricted data with cross border treatment only where the responsible party meets this Law's data protection standards or standards equal to or higher than it, unless the data subject consented, a contract requires the transfer, it is a banking, monetary or securities transfer, or an international treaty Panama has ratified compels it.

Article 33 makes an international transfer of personal data lawful if at least one of thirteen listed conditions is met, among them the data subject's consent, the receiving country or organization providing an equivalent or superior level of protection, a treaty or law to which Panama is party, medical necessity, transfer within the same corporate group, a contract in the data subject's unequivocal interest, a public interest or legal defense need, judicial cooperation, a banking or securities transaction, international intelligence cooperation against organized crime, a binding self-regulation mechanism, or contractual clauses that meet this Law's protections, and holds both the transferring party and the recipient responsible for the lawfulness of the processing transferred.

Article 19 gives a data subject the right not to be subject to a decision based solely on automated processing of their personal data that produces a negative legal effect or a detriment to a right, where the decision evaluates aspects such as their personality, health status, work performance, credit, reliability or conduct.

The right does not apply where the data subject consented to the decision, the decision is necessary to enter into or perform a contract or legal relationship with the controller, or a special law or its implementing regulations authorize it.

Article 15 gives every data subject the irrenounceable rights of access, rectification, cancellation, opposition and portability, including a structured, commonly used, machine readable copy of their personal data that can be moved to another responsible party, at least where the data subject supplied the data directly, a relevant volume of automated processing is involved, or the data subject consented or a contract requires it.

Article 16 requires a response to an access request within ten business days, free of charge, and article 17 requires an inaccurate, erroneous or incomplete datum to be corrected within five business days of the request, letting the Autoridad Nacional de Transparencia y Acceso a la Información decide when a datum is inaccurate or unfounded.

Article 18 lets a data subject take an unanswered request to that Authority, which may then demand information and carry out verifications limited to the complaint presented. Article 21 bars limiting a data subject's access, revocation, cancellation, opposition or blocking rights by any act or agreement between parties, voiding any clause that tries. Article 22 lets a data subject reach any one of several responsible parties feeding a shared database.

Article 23 withholds an information, rectification, cancellation or blocking request where it would impede a pending administrative or judicial process or state security, and withholds rectification, cancellation or blocking of data a legal mandate requires to be kept, outside the cases special laws allow. Article 44 extends these rights to personal data already held in a database that existed before the Law took effect.

Article 34 creates the Consejo de Protección de Datos Personales as a consultative body drawing members from government ministries, regulators, the private sector, the bar and the banking industry, and article 35 gives it the power to advise the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI), recommend public policy, and evaluate submitted cases.

Article 36 empowers ANTAI to sanction a responsible party or database custodian found, on investigation of a complaint, to have infringed a data subject's rights, sets fines from B/.1,000 to B/.10,000 graduated by the infraction's gravity, and allows reconsideration before ANTAI's own Dirección and appeal to its director general.

Article 37 lets a data subject sue a responsible party in the ordinary courts for patrimonial or moral damage its unlawful processing caused, independent of ANTAI's administrative sanction.

Articles 38 to 41 classify infractions as minor, serious or very serious, minor being a late report to ANTAI, serious spanning consent failures, principle violations, breach of confidentiality, obstructing a data subject's rights, or failing to secure stored data, and very serious spanning bad faith collection, violating the sensitive data rules, ignoring an ANTAI suspension order, an unlawful international transfer, or repeating a serious infraction.

Article 43 sanctions a minor infraction with a citation, a serious infraction with a proportionate fine, and a very serious infraction with closure of the database's registries or suspension of the processing activity in addition to a fine, treats repetition of the same infraction within three years as recidivism, and requires every sanctioned fact to be documented so ANTAI can weigh gravity, repetition or recidivism.

Articles 45 and 46 give ANTAI its own budget line to carry out the Law and task the Órgano Ejecutivo with regulating the Law in coordination with ANTAI.

Article 4(11) defines a sensitive datum as one touching a person's intimate sphere, or whose misuse could cause discrimination or a serious risk, naming racial or ethnic origin, religious, philosophical or moral belief, union affiliation, political opinion, health, sexual orientation, and genetic or biometric data among the enumerated examples.

Article 13 bars transferring sensitive data at all, except with the data subject's explicit authorization, to safeguard the life of a data subject who cannot consent, for the recognition or defense of a right in a judicial proceeding, or for a historical, statistical or scientific purpose that first dissociates the data subject's identity.

Article 8 requires consent to processing sensitive health data to be prior, irrefutable and express, a heightened standard above the ordinary consent article 6 sets. Article 20 lets a public or private health establishment or medical professional collect and process the health data of its own patients, subject to professional secrecy and this Law.

Article 289 sanctions with two to four years' imprisonment anyone who improperly enters or uses a database, network or computer system.

Article 290 imposes the same two-to-four-year range on anyone who improperly seizes, copies, uses or modifies data in transit or held in a database or computer system, or who interferes with, intercepts, obstructs or prevents its transmission; neither article conditions the offence on defeating a technical security measure, so a plain reading reaches unauthorized use of a public, unauthenticated page as well as a password-protected one.

Article 291 aggravates the penalty by a third to a sixth when the conduct targets data held by a public office, a public, private or mixed institution providing a public service, or a bank, insurer or other financial or securities institution, and aggravates it further when committed for profit.

Article 292 aggravates the penalty by a sixth to a third when the offender is the person in charge of the database or system, a person authorized to access it, or someone who used privileged information to commit the offence. The consolidated text carries an adoption date of 15 April 2010 for the compiled version, and no day on which these articles came into force has been located.

Article 1 applies the Acuerdo to official banks, general-licence banks and international-licence banks for which the Superintendencia is the home supervisor. Article 3 requires a bank to keep an organizational structure suited to its size, complexity and risk profile to manage information technology and its associated risks.

Article 3 requires an information technology risk methodology that guarantees system security through at least logical access, physical security and network security controls. Article 8 requires banks to identify, measure, monitor, control, mitigate and report the information technology risks to which they are exposed. Article 11 gives the information security unit of a bank, as a minimum, the function of keeping systems protected against new threats and existing vulnerabilities.

Article 11 also gives the information security unit the function of coordinating intrusion and vulnerability tests of the bank technology environment. Article 12 requires the business continuity plan of a bank to include stress tests, alternative processing with backup of information and systems, recovery capacity for critical services and communication processes. Article 15 provides that the Superintendent sanctions a breach of the Acuerdo under Title IV of the Banking Law. Article 16 provides that the Acuerdo applies from 1 January 2013.

Article 1 applies the Acuerdo to official banks, general-licence banks and international-licence banks that provide services or products to their customers through electronic banking. Article 10 requires every bank to run intrusion and vulnerability tests carried out by suitable professionals external to the bank. Article 10 sets the external intrusion test at a minimum of once a year.

Article 11 requires a bank to develop incident response and communication plans to manage, stop and mitigate problems that disrupt its electronic banking systems and services. Article 15 requires a bank to ensure the authenticity, integrity, confidentiality and non-repudiation of a valid transaction once accepted, together with segregation of duties and authorization controls. Article 22 provides that the Superintendent sanctions a breach of the Acuerdo under Title IV of the Banking Law. Article 24 provides that the Acuerdo applies from 10 September 2012.

Article 1 applies the Acuerdo to official banks, general-licence banks and international-licence banks for which the Superintendencia is the home supervisor. Article 11 gives the information security unit of a bank the function of monitoring and handling information security incidents. Article 11 also requires the information security unit to notify the Superintendencia, using the form it has established, when the bank suffers attacks. Article 16 provides that the Acuerdo applies from 1 January 2013.

Article 1 applies the Acuerdo to official banks, general-licence banks and international-licence banks that provide services or products to their customers through electronic banking. Article 17 requires a bank to report to the Superintendencia any event or attempted fraud in its electronic banking services, using the form provided. Article 17 requires the report to be sent within the period the Superintendencia sets, even if the origin of the event has not yet been determined. Article 24 provides that the Acuerdo applies from 10 September 2012.