Ecuador

Article 1 guarantees the right to protection of personal data, including access to and decision over one's own data, and article 2 applies the Act to the processing of personal data in any medium, automated or not, by any public or private controller or processor, with narrow exclusions for purely personal or household use and for the personal data of deceased persons.

Article 25 lists sensitive data, children's and adolescents' data, health data, and disability data as special categories, and article 26 prohibits processing sensitive data absent the data subject's explicit consent or another enumerated ground.

Article 20 gives every data subject the right not to be the object of a decision based solely or partly on automated processing, including profiling, that produces legal or similarly significant effects, unless a narrow exception applies, and article 21 extends heightened protection to children's and adolescents' data in that same context.

Article 43 requires a controller to notify a personal-data security breach to the Authority and to the telecommunications regulator as soon as possible and no later than five days after becoming aware of it, and a processor must notify the controller within two days. International transfers require an Authority adequacy resolution, appropriate safeguards meeting a stated standard, or, for other cases, the Authority's prior authorization.

The Authority, the Autoridad de Protección de Datos Personales headed by the Superintendente de Protección de Datos, may impose corrective measures and, for private-law entities and public enterprises, administrative fines of between 0.7% and 1% of the prior fiscal year's business turnover for grave infractions; the corrective-measures and sanctions regime, unlike the rest of the Act, did not begin to apply until two years after the Act's publication in the Official Registry.

This resolution binds any controller or processor that develops, trains, implements, deploys, or provides an artificial-intelligence system that processes personal data, whenever that system falls within the LOPDP's material and territorial scope. Article 4 guarantees, at all times, the data subject's right not to be the object of a decision based solely or partly on automated valuations, together with the right to information and the right to object.

Article 5 requires the controller or processor to inform the data subject clearly and specifically about the AI-based processing, and article 6 requires a prior risk-management process and impact assessment before developing an AI system that will process personal data. The resolution states that it takes effect upon its publication in the Registro Oficial; the signed text itself does not independently confirm that publication has occurred.

Article 234 punishes, with three to five years' imprisonment, a person who, without authorization, accesses all or part of a computer, telematic, or telecommunications system, or remains inside it against the will of the person with the legitimate right, in order to unlawfully exploit the access obtained, modify a web portal, divert or redirect data or voice traffic, or offer the services those systems provide to third parties without paying the legitimate service providers.

Because the offence's trigger is unauthorized access exploited for one of those listed purposes, reading a public, unauthenticated page without defeating an access control and without one of the listed purposes falls outside a plain reading of the provision.

Article 232 punishes, with three to five years' imprisonment, a person who destroys, damages, deletes, deteriorates, alters, suspends, obstructs, causes malfunction or unwanted behaviour of, or suppresses computer data, e-mail messages, or an information, telematic, or telecommunications processing system or its logical components.

The same penalty reaches designing, developing, programming, acquiring, sending, introducing, executing, selling, or distributing malicious software or programs meant to cause those effects, and destroying or altering, without authorization, the technological infrastructure needed to transmit, receive, or process information. The penalty rises to five to seven years where the target is infrastructure for a public service or linked to public safety.

Article 230(1) punishes, with three to five years' imprisonment, a person who, without prior judicial order and for their own benefit or a third party's, intercepts, listens to, diverts, records, or observes, in any form, a computer datum at its origin, destination, or inside a computer system, or a signal or data transmission, with the aim of obtaining registered or available information.

Reading a public, unauthenticated page does not fit a plain reading of an offence built around a judicial-order requirement and an interception of a transmission.

Article 229 punishes, with one to three years' imprisonment, a person who, for their own benefit or a third party's, reveals information registered or contained in files, archives, databases, or similar media, through or directed at an electronic, computer, telematic, or telecommunications system, deliberately and intentionally breaching the secrecy, privacy, and intimacy of persons.

The penalty rises to three to five years where a public servant, or a bank or savings-and-credit-cooperative employee carrying out financial intermediation, or a contractor commits the same act.

Article 211 states that using or exploiting a protected work or performance in the cases the next article lists is not a violation of patrimonial rights, provided it does not conflict with the work's normal exploitation and does not cause unjustified prejudice to the rights holder's legitimate interests, tested against a four-factor standard (the purpose and nature of the use, the nature of the work, the amount used relative to the whole, and the effect on the work's market value).

Article 212 then lists the acts that do not require authorization, including brief quotation for analysis, comment, or criticism with attribution, and, at item 9, an enumerated set of purposes for which a library, archive, or museum may reproduce a single copy of a work already in its collection, the eighth of which is text mining.

The exception is therefore not a general-purpose text-and-data-mining allowance: it is available only to a library, archive, or museum reproducing a work already in its own collection, not to a commercial or research entity scraping or mining text from the open web at large.

Article 140 protects a compilation of data or other material, in any form, as such, only where the originality of the selection or arrangement of its contents constitutes an intellectual creation; that protection does not extend to the underlying data or information compiled, and does not affect any copyright or related right subsisting in the works or performances the compilation contains. The article also states that the protection it recognizes for databases does not apply to software.

Ecuador therefore has no sui generis database right of the European kind, protecting a producer's investment in obtaining, verifying, or presenting the contents regardless of originality; only a compilation-copyright model tied to originality of selection or arrangement.

Article 212(1) permits, without the rights holder's authorization, including brief fragments of an already-disclosed written, sound, audiovisual, artistic, photographic, or figurative work in one's own work, provided the inclusion is by way of quotation or for analysis, comment, or critical judgment, with teaching or research purposes, to the extent justified by that purpose, and provided the source and author's name are indicated and the use is not a disguised exploitation of the work.

The same provision states that periodic compilations made in the form of press reviews or a press digest are considered quotations for this purpose. That treatment is not capped at a headline-length or short-extract threshold in the article's text, and article 211 additionally requires that the use not conflict with the work's normal exploitation and not cause unjustified prejudice to the rights holder, tested against a four-factor standard.