Ecuador's Preliminary Draft Of The Data Protection Law

• Published date: 19 March 2021
• Subject Matter: Privacy, Data Protection
• Law Firm: CorralRosales
• Author: Mr Rafael Serrano

For the first time in history, Ecuador will have a Data Protection Law that will follow the European normative standard. Our associate Rafael Serrano, a collaborator for the IAPP blog, writes about it.

Despite never having had a specific law, data protection in Ecuador is restricted and limited by the various laws that include this particular legislation, such as the Telecommunications Law, the Electronic Commerce Law, the Criminal Law, and the Financial and monetary law.

After two significant circumstances in the country, the government determined it essential for the country to have its own law. It would protect Ecuadorian citizens' data, allowing the authorities to take action if it was not complied with. One of the revealing events was a data breach that affected practically the entire population. The other one corresponds to the evolution of the Data Protection Law in other countries. This limits Ecuador when it comes to transferring data internationally.

The current bill, which is currently being debated in Congress, contains 76 articles and 12 chapters focused on the following aspects:

Extraterritorial scope

Processors and controllers who offer services and goods to Ecuadorian residents but as long as they are located outside of our country.

Data protection principles

As published by Serrano, "the bill recognizes many of the data protection principles accepted throughout the world, such as limitation of purpose, transparency, confidentiality, limited retention, responsibility and accuracy of data, guidelines established and obligations for data processors and controllers."

Lawful basis for the processing of personal data

With this draft Law, there will be contractual and pre-contractual obligations, the protection of vital interests, the processing of data from public databases, and the exercise of tasks carried out in the public interest or exercise of public powers.

New data subjects rights

The law will include the right to information, access...