Uruguay

Article 9 requires free, prior, express, and informed consent before processing personal data, subject to narrow exceptions including data drawn from public sources or gathered for a state function. Article 18 bars collecting sensitive data (racial or ethnic origin, political opinion, religious or moral conviction, union affiliation, health, or sexual life) without the data subject's express written consent, absent an interest-general legal authorization.

Article 16 gives a person the right to challenge an administrative act or private decision based solely on automated processing of personal data that significantly affects them, and to obtain from the controller the criteria and the program used to reach it.

Article 23 prohibits transferring personal data to a country or organization that does not provide an adequate level of protection, subject to enumerated exceptions (the data subject's unambiguous consent, contractual necessity, an important public interest, or a public register open to consultation) and to case-by-case authorization by the Unidad Reguladora y de Control de Datos Personales (URCDP) where a controller offers sufficient contractual safeguards.

Article 12, as rewritten by Ley N° 19.670 art. 39, imposes a proactive-accountability duty: privacy by design, privacy by default, and a data-protection impact assessment among the measures a controller and processor must adopt and be able to demonstrate.

Ley N° 19.670 art. 37 (2018), now regulated by Decreto N° 64/020 (2020), extends the law to a controller or processor established outside Uruguay when it offers goods or services to Uruguayan residents, monitors their behavior, or uses means located in the country, requiring a locally domiciled representative before the URCDP unless the means are used solely for transit.

Ley N° 19.670 art. 38 requires the controller or processor to notify both the data subjects and the URCDP immediately and in detail on learning of a security breach, coordinating with the national cybersecurity incident response centre (CERTuy).

Ley N° 19.670 art. 40 requires a public entity, a wholly or partly state-owned private entity, or a private entity that processes sensitive data as a main line of business or processes large volumes of data, to designate a data-protection officer with technical autonomy.

Article 37's habeas data action lets any person bring an effective judicial claim to learn what personal data about them is held, for what purpose, and to demand its rectification, inclusion, or deletion where it is erroneous, false, outdated, unlawfully processed, or discriminatory.

Article 35 arms the URCDP with graduated administrative sanctions for a violation of the law (observation, warning, a fine of up to UI 500,000 (Unidades Indexadas, an inflation-linked accounting unit), a five-day suspension, or closure of the database); the law does not attach a criminal penalty to a breach of these duties.

Article 297 bis (acceso ilícito a datos informáticos) punishes with six to twenty-four months' imprisonment anyone who, by computer or telematic means, without authorization and without just cause, accesses, interferes with, discloses, sells, or transfers another's information held on a digital medium; because the offence's trigger is acting without authorization, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.

Article 297 ter punishes unauthorized interception of non-public data transmissions with the same six-to-twenty-four-month range.

Article 297 quater (vulneración de datos) punishes, with the same six-to-twenty-four-month range, accessing, appropriating, using, or modifying a third party's confidential data held on a digital or other medium without the holder's authorization, and separately punishes disclosing, revealing, or transferring such data to a third party with one to four years' imprisonment, aggravated where the data are personal data protected under Ley N° 18.331.

Article 358 quater (daño informático) punishes destroying, altering, or rendering unusable data or computer systems without authorization and with intent to cause harm with six to twenty-four months' imprisonment. Article 358 quinquies (abuso de los dispositivos) punishes producing, acquiring, importing, marketing, or supplying to a third party a program, system, or access credential unequivocally intended for committing an offence, with the same six-to-twenty-four-month range.

Article 44 treats reproducing, distributing, communicating, or making a work available to the public without the author's consent as illicit reproduction, so copying a copyrighted text found on the open web without permission or an applicable exception infringes unless article 45 covers it. Article 45 numeral 4 excepts a transcription made for the purpose of comment, criticism, or controversy, a general quotation right rather than a text-and-data-mining exception.

Article 45 numeral 3 excepts news, reports, journalistic information, or recordings of general interest, but only where the exact version is preserved and the source is stated, a condition suited to a verbatim press clipping rather than to extracting short snippets or training a model on the underlying text.

Uruguay has no text-and-data-mining exception and no machine-readable opt-out mechanism of that kind; a service that reproduces or trains on scraped copyrighted text rests only on the numeral 4 quotation ground if its use can be characterised as comment, criticism, or controversy.

Article 5 protects a compilation of data or other materials, in any form, as a copyright work when the selection or arrangement of its contents constitutes an intellectual creation, and states expressly that this protection does not extend to the underlying data or materials themselves and is without prejudice to any copyright that subsists in them separately.

Uruguay confers no sui generis database right distinct from this originality-based compilation copyright, so a database whose selection or arrangement is not itself an intellectual creation, such as a routine or exhaustive listing, receives no protection under this article, and copying the underlying facts or data out of a protected compilation does not infringe it.

Article 45 lists cases that are not illicit reproduction. Numeral 3 excepts news, reports, journalistic information, or recordings of general interest from the consent that article 44 otherwise requires, on the sole conditions that the exact version is preserved and the source is stated.

The exception is not capped at a headline or short-extract length and is not confined to the press industry, but the requirement to keep the exact version suits reproducing a news item whole, the way a press clipping does, rather than obviously covering an aggregator's extraction of a headline or a short snippet distinct from the source's own wording. No reported Uruguayan decision has applied numeral 3 to a systematic news aggregator as opposed to a traditional press review or broadcaster.

Separately, article 5 confines copyright to expressions and excludes ideas, procedures, operating methods, and mathematical concepts as such, so a bare fact or the news of the day is never itself a protected work under Uruguayan law. Uruguay has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright law, and no located case law on hyperlinking or framed display.