Privacy Law Survey 2021 - Peru

• Published date: 30 December 2021
• Subject Matter: Privacy, Data Protection, Privacy Protection
• Law Firm: Ally Law
• Author: Mr Roberto Santivanez (Santiv'ez Abogados) and Fidel Rocha (Santiv'ez Abogados)

Consent

May consent be used as a legal basis for processing worker information? (Y/N - if N, please explain)

Yes.

Are there any specific worker data collections or processing operations that require prior consent? (Y/N - if Y, when is consent required)

Yes. The data not necessary for the execution of the contract must be provided with the prior consent of the workers. Similarly, the data required for purposes other than the execution of the contract.
There are court rulings that establish that the employer may only check the worker's email if a judge orders it or the worker himself consents.

Are there exceptions that will allow employers to collect and treat workers data without consent? (Y/N - if Y, list the exceptions)

Yes. According to article 14 of Law N' 29,733, Personal Data Protection Law, employers may treat employees' data without employees' consent when it is personal data necessary to execute the contractual relationship.

Privacy Notice

Is the company required to provide a privacy notice to workers? (Y/N)

Yes.

Does the worker privacy notice need to address security measures?

Not necessarily. Security measures are mandatory but there is no legal obligation to include them in the privacy notice to workers.

Are there any other unique disclosure requirements with respect to the privacy notice (e.g. list data retention periods, state legitimate bases, etc.)?

Yes. Employees should be informed about who is the controller of their data; the purposes for which your data will be used; and their rights with respect to said data ("ARCO"). Employees must also be informed about the employer's video surveillance policy.

Data Subject Rights

Are there data subject rights for workers? (Y/N - if Y, please list)

Yes. Workers have the same rights as any data subject (i.e. to be informed, to access, to rectification, to erasure, to object/opt-out, etc.). In addition, workers have rights that derive from the general rule of the Civil Code.

What is the timeframe to respond to data subject requests from workers?

In case of worker's request to access the timeframe is 20 business days and worker's request for rectification, cancellation or opposition the timeframe is 10 business days.

Are there exceptions to responding to data subject requests from workers?

Yes. Requests may be denied when protecting the rights and interests of third parties or when this may hinder ongoing legal or administrative actions related to the investigation on compliance with tax...