Panama

Article 1 sets the Law's object as the principles, rights, obligations and procedures governing personal-data protection. Article 1's second paragraph lets any natural or legal person, public or private, for-profit or not, process personal data provided it does so under the Law and for permitted purposes. Article 2 lists nine governing principles, including loyalty (no deceptive or fraudulent collection), purpose limitation, proportionality, veracity, security, and portability.

Article 11 defines a sensitive datum as one touching a person's intimate sphere or whose misuse could cause discrimination or a serious risk, naming racial or ethnic origin and religious, philosophical and moral beliefs among the enumerated examples. Article 13 bars transferring sensitive data except with the data subject's explicit authorization or on narrow statutory grounds.

Article 19 gives a data subject the right not to be subject to a decision based solely on the automated processing of their personal data that produces a negative legal effect or a detriment to a right, where the decision evaluates aspects of personality, health, job performance, creditworthiness, reliability or conduct, unless the subject consented, the decision is necessary to perform a contract, or a special law authorizes it.

Article 33 makes an international transfer of personal data lawful if at least one of several conditions is met, including the data subject's consent or the receiving country or organization providing an equivalent or superior level of protection. ANTAI, with the support of the Autoridad Nacional para la Innovación Gubernamental on information-technology matters, supervises compliance.

Article 47 provides that the Law takes effect two years after its promulgation, and the Law's Gaceta Oficial publication date of 29 March 2019 places that entry into force on 29 March 2021. Decreto Ejecutivo No. 285 de 2021 develops the Law's implementation in coordination with ANTAI and states in its own recitals that this deferred entry into force took effect on 29 March 2021.

Article 289 sanctions with two to four years' imprisonment anyone who improperly enters or uses a database, network or computer system.

Article 290 imposes the same two-to-four-year range on anyone who improperly seizes, copies, uses or modifies data in transit or held in a database or computer system, or who interferes with, intercepts, obstructs or prevents its transmission; neither article conditions the offence on defeating a technical security measure, so a plain reading reaches unauthorized use of a public, unauthenticated page as well as a password-protected one.

Article 291 aggravates the penalty by a third to a sixth when the conduct targets data held by a public office, a public, private or mixed institution providing a public service, or a bank, insurer or other financial or securities institution, and aggravates it further when committed for profit.

Article 292 aggravates the penalty by a sixth to a third when the offender is the person in charge of the database or system, a person authorized to access it, or someone who used privileged information to commit the offence. The consolidated text names an adoption date of 15 April 2010 for this compiled version of the Código Penal, but that date marks the compilation rather than a stated commencement day for these specific articles, so no commencement date is recorded here.