Category Archives: Bulletin

On October 25, 2024, the Data Protection Authority (“SPDP”) issued Resolution No. SPDP-SPDP-2024-0013-R, enacting the Regulation on the Submission and Processing of Complaints and Requests for Data Protection (“Regulation”).

The main points are below:

1. Purpose and Scope of the Regulation

The Regulation governs the submission and processing of complaints and requests before the SPDP following the principles of expeditiousness, lawfulness, timeliness, transparency, good faith, objectivity, effectiveness, efficiency, and quality.

This Regulation applies when:

• The exercise of the data subjects’ rights has been violated.
• Data protection principles have been breached.
• The data controller or processor has failed to comply with obligations set forth in the data protection regulatory framework.

1. Complaints and Requests

• Complaint: A mechanism by which an individual or an entity notifies the SPDP of an alleged violation of data protection regulations, such as the improper use of personal data, security breaches, or unlawful practices.
• Request: A petition filed by a data subject to address a specific issue related to processing their personal data, such as a lack of response or improper data handling. The objective is to request that the controller or processor correct their actions, recommend corrective measures, or initiate an administrative sanction procedure.

1. Submission of Complaints and Requests

Complaints and requests may be submitted physically at the SPDP offices or electronically through the channels made available.

1. Complaint Procedure

Once a complaint is submitted, the SPDP may initiate preliminary actions or impose provisional protective measures to safeguard the data subject’s rights. These measures may include:

• Withdrawal of products, documents, or other goods.
• Access limitations or restrictions.
• Removal of individuals.
• Suspension of the processing activity.
• Closure of establishments.

During the preliminary proceedings, the SPDP will:

• Identify the alleged perpetrator(s).
• Establish the specific circumstances of the case.
• Determine relevant contributing factors.
• Assess whether sufficient grounds exist to initiate an administrative procedure.

If necessary, the SPDP may order further investigations, inquiries, audits, or inspections to clarify the facts. The administrative act initiating the preliminary action will be notified to the investigated party in accordance with the Administrative Code (“COA”).

Once the preliminary actions are completed the SPDP will issue an initial report which will be notified to the investigated party. The party will have ten working days from the date of notification to submit its response.

If no response is provided within the given term, the preliminary report will have full legal effect and become the final report, concluding the initial actions.

The SPDP has a maximum of six months from the issuance of the administrative act to decide whether to initiate an administrative sanctioning procedure.

1. Request Procedure

Requests submitted by data subjects must meet the requirements established in the Regulation. If the request is incomplete or unclear, the SPDP will order the petitioner to amend or clarify it within five days of notification. Failure to do so will result in the request being archived.

The SPDP will assess whether the request falls within its jurisdiction and, if necessary, may open a thirty-day evidentiary period during which the data subject and controller may submit additional evidence.

Within twenty days following the conclusion of the evidentiary period, the SPDP will issue a report that may contain:

1. A recommendation on whether or not to initiate an administrative sanction procedure.
2. A recommendation regarding the corrective measures to be implemented.

Corrective measures and administrative sanction procedures will be governed by the provisions of the COA, Data Protection Law, the Regulations to the Data Protection Law, and any other applicable regulations issued by the SPDP.

The Regulation came into effect on October 25, 2024.

Rafael Serrano, Partner at CorralRosales
rserrano@corralrosales.com
+593 2 2544144

On October 22, 2024, the Ministry of Labor issued the Ministerial Agreement No. MDT-2024-200, hereinafter the “Agreement”. We highlight the following:

• The Agreement could be applied by employers of the private sector that require a temporary modification of the working day due to the national electric emergency.

• The modification of the working day must be implemented by means of a written mutual agreement between the employer and the employees and must be registered in the SUT system within 30 days after the signing of the agreement.

• The modification of working hours should adjust to the following:
  1. Employees shall be entitled to a rest of 72 continuous hours.
  2. Employees could agree to a working day from 7:00 a.m. to 5:00 p.m. on Mondays, Tuesdays, Wednesdays and Thursdays or a working day from 7:00 a.m. to 5:00 p.m. on Thursdays, Fridays, Saturdays, and Sundays.
  3. Shifts that exceed 40 hours per week shall be paid as overtime.

• The modification of the working hours can be terminated either by agreement of the parties or automatically by the end of the energy crisis.

• The system will be enabled for the registration of the working day modifications within 10 days from the date of the Ministerial Agreement.

Edmundo Ramos, Partner at CorralRosales
eramos@corralrosales.com
+593 2 2544144

María Victoria Beltrán, Senior Associate at CorralRosales
mbeltran@corralrosales.com
+593 2 2544144

The Ministry of Production, Foreign Trade, Investment, and Fisheries has published the Free Trade Zone Investor Kit, which contains the instructions for requesting approval for Free Trade Zone projects and Operator´s qualifications.

Below is a list of the documents that must be submitted in both physical and digital formats:

1. Application form for Free Trade Zone declaration and Operator User qualification, which must include the following documents:

1. 1. Certificates of compliance issued by the Internal Revenue Service, the Ecuadorian Social Security Institute, and the Superintendence of Banks or the Superintendence of Companies, Securities, and Insurance, as applicable.
   2. Documents required for approval as an Operator of a Free Zone Trade:
   1. 1. By-laws of the company which must indicate that its corporate purpose is the execution of Free Trade Zone activities;
      2. Taxpayer Registration Certificate (RUC);
      3. Appointment Document and ID card of the legal representative.
      4. Notarized Sworn statement declaring that the applicant has not previously been an operator or administrator of a free trade zone whose authorization has been revoked due to a sanctioning procedure. and,
      5. Documents that display the financial capacity of the applicant.

       

1. Master Development Plan Report form, which must include:

1. 1. Technical report on the project location, execution timeline, land plans, project layout and design, identification of sustainable development goals (SDG), environmental study or license, and details of potential users and support services.
   2. Economic report that covers social, economic, and productive indicators, generation of economies of scale, socioeconomic aspects, job creation details, financial projections, economic and financial evaluation, and project’s financial structure and capacity.
   3. Market report regarding expected participation in local and international markets, market strategy, and its relation to potential users, business model, potential competition, and a preliminary list of imports.

1. Annex form to the Master Plan, which must include:

1. 1. Operator´s investment schedule;
   2. SDG compliance schedule; and,
   3. Employment generation schedule.

    

1. Request index referencing the location of each document.

The forms and instructions are available at the following URL.

Fernanda Inga, Senior Associate at CorralRosales
finga@corralrosales.com
+593 2 2544144