Electronic Transactions Law, Protection of Personal Electronic Data

Article 2 applies the Law to natural and legal persons, public or private, that apply information and communication technologies in their activities, including electronic or commercial transactions and electronic government.

Article 63 requires any data processor who electronically collects, processes, or discloses personal data to keep it accurate, complete, and up to date, and to disclose the purpose of collection and the processor's identity before collecting it, limiting later use to that stated purpose; where data was not collected from the data subject directly, the processor must on request give the subject the reason for collection and the processor's identity, with an exception where notice is impossible, disproportionately burdensome, permitted by law, or the data is collected for statistical, historical, or scientific purposes.

Article 63(5) requires the processor to protect personal data against risk, loss, unauthorised access, destruction, use, modification, or disclosure. Article 63(6) gives every person the right to obtain from a data controller confirmation of whether it holds data about them, and to remove, rectify, complete, or alter that data on acceptance of their request.

Article 63(8) exempts electronic collection, processing, or disclosure of personal data for journalism, artistic or literary expression, or when decided by the competent authorities to safeguard public security and national defence.

Article 64 bars accessing computerised archives, files, records, or databases to learn a third party's personal data, and bars transferring personal data between different information systems belonging to distinct services or institutions, except where established by legal instrument or judicial decision.

Article 65 requires the data processor to designate an individual responsible for data protection and to safeguard retained information, including information transferred to a third party for processing, subject to the same journalism, artistic-expression, and public-security exemptions as Article 63. Article 67(m) makes violating the data-processor obligations of this chapter a punishable contravention.

Article 68(c) sets the fine for that contravention at 30 to 90 times the public-service minimum wage, decided by the sector regulator under Article 69, unless a more severe penalty applies under separate criminal legislation.