Ecuador – Page 14 – CorralRosales

Risks and data protection impact assessments

15 February, 2024

Any processing of personal data involves risk. Processing is any activity performed with personal data, including collection, conversion, use and disposal. The risk arises from the likelihood of negative events occurring with personal data, such as theft, removal, alteration, or deletion.

Those who carry out the processing of personal data must clearly identify the risks they face, to mitigate, manage or assume them, through the adoption of different security measures. Risk identification can be done through risk analysis, which will help identify high-risk treatments. On the other hand, the data protection impact assessment (hereinafter the “DPIA“) will make it possible to evaluate possible violations of rights and the mechanisms to reduce them.

The Organic Law for the Protection of Personal Data (hereinafter the “LOPDP”)[1] established the obligation to have a risk methodology and to carry out a DPIA, the purpose of which is to foresee the impacts and risks to the privacy of data subjects. Therefore, the LOPDP requires the implementation of security and control measures to guarantee the rights and freedoms of individuals.[2]

I. What is a DPIA?

The Regulation to the LOPDP[3] (hereinafter the “Regulation”), in accordance with the Article 29 Working Party’s[4] statement on the DPIA, defines impact assessment as a “[…] preventive analysis, of a technical nature, whereby the controller assesses the actual impacts of data processing, in order to identify and mitigate potential risks […]”[5].

II. How do I know if a DPIA should be done?

According to the LOPDP, the DPIA is mandatory when the data processing “entails a high risk to the rights and freedoms of the data subject”. Article 42 of the LOPDP provides some examples of when data processing may generate high risks:

1. Systematic and comprehensive evaluation of personal aspects of natural persons, which is based on automated processing (such as profiling) and on the basis of which decisions are made that produce legal effects for such persons.

For example, a financial institution that researches its customers in a credit reference database; or a computer program that uses the behavioral history of persons deprived of liberty to automatically determine whether they will be granted parole[6].

2. Large-scale processing of the special categories of data referred to in Article 25 of the LOPDP, or of personal data relating to criminal convictions and offences.

Large-scale processing involves a large amount of data and many data subjects from a wide geographic diversity[7]. Article 4 of the Regulation provides some examples of large-scale treatments:

Patient data from hospitals and healthcare institutions.
Data on the movement of individuals using public transportation.
Real-time geolocation data.
Data from customers from insurance companies or financial institutions.
Data for behavioral advertising by a search engine.
Data of content, traffic, and location data by telecommunications or internet service providers.

3. Systematic monitoring of a publicly accessible area on a large scale

This type of observation[8] is a criterion for determining high risk, because personal data may be collected in circumstances where data subjects may not be aware of who is collecting their data and how it will be used. In addition, it may be impossible for individuals to avoid being subjected to this type of processing in public spaces (or publicly accessible spaces). As an example, a camera placed on a public road to record and monitor the behavior of drivers is noted.

From these examples, it must be assessed whether a processing of personal data is likely to generate a high risk. This is particularly important since failure to execute the DPIA when it is mandatory as determined by the LOPDP and the Regulation could constitute a serious infringement of the LOPDP and result in a fine of between 0.7% and 1% of the revenue for the financial year immediately preceding the financial year in which the fine is imposed.

III. What should be included in a DPIA?

The DPIA should be carried out prior to the start of personal data processing activities. Therefore, companies, as data controllers, should prepare their DPIA before and during the initial planning of their new projects. In Article 32 of the Regulation, in line with international experience[9], it is determined that the DPIA must be submitted to the data protection authority and that it must contain the following points:

1. Description of the operations and purposes of processing.

2. Reasoning for the necessity to carry out the processing.

3. Risk assessment to the rights of the data subjects; and,

4. Security measures to address the risks.

The DPIA must be a systematic process that applies objective, repeatable, and comparable methodologies and methods of execution; consequently, a DPIA must be structured in different phases. The LOPDP determines as one of the obligations of those responsible for the processing of personal data to use appropriate methodologies for the analysis and management of risks.

In summary, the LOPDP and the Regulation establish certain examples and criteria to determine in which cases a DPIA must be carried out on a mandatory basis. However, we will have to wait for the actions of the Data Protection Superintendency, whose head is not yet named, to know the interpretation and development of the concepts in the practical application of the LOPDP and the Regulation.

[1] The LOPDP entered into force on May 26, 2021, and its sanctioning regime is fully applicable as of May 26, 2023.

[2] The DPIA process is not new in Comparative Law, in the EU it is established in the General Data Protection Regulation. It is also contemplated in the legal systems of Australia, Mexico, Canada, Japan, South Africa, South Korea, the United States and New Zealand, among others.

[3] Issued by Executive Decree 904 of November 6, 2023.

[4] Article 29 Working Party. (2017). Guidelines on data protection impact assessment. https://www.aepd.es/sites/default/files/2019-09/wp248rev01-es.pdf

[5] Article 29 of the Regulation.

[6] Spanish Data Protection Agency (2021). Risk management and impact assessment in personal data processing. https://www.aepd.es/es/documento/gestion-riesgo-y-evaluacion-impacto-en-tratamientos-datos-personales.pdf

[7] Article 29 of the Regulation.

[8] The Regulations interpret “systematic” to mean one or more of the following:

pre-established, organized or methodical;
taking place as part of an overall data collection plan;
carried out as part of a strategy.

[9] Guidelines on Data Protection Impact Assessment of the Article 29 Working Group, Data Protection Impact Assessment Guide of the Argentine Data Protection Authority, and, Guide for the Preparation of Privacy Impact Assessments of the National Institute of Transparency, Access to Information and Protection of Personal Data.

Christian Razza
Associate at CorralRosales
crazza@corralrosales.com

Rafael Serrano
Partner at CorralRosales
rserrano@corralrosales.com

New regulations for rejecting customs declarations

7 February, 20248 February, 2024

On January 29, 2024, the Customs Authority (SENAE) issued Resolution SENAE-SENAE-2024-0007-RE by which new regulations for rejecting customs declarations in the ECUAPASS customs system, were issued.

The amendments include:

1. The grounds for rejecting the customs declaration are modified:

– Causes that do not generate a fine:

Ecuapass system error: The declarant must request the rejection to the District Director. The request will be verified by the Directorate of Information Technology within 5 days.
When the rule allows the rejection to carry out a customs procedure or operation: The District Director shall reject the declaration without the need for a request from the declarant.
Re-shipment of goods, whether or not taxes have been paid: Rejection may be requested by the declarant to the District Director or be made without his request.
The merchandise did not arrive to the national territory after 15 days of the transmission of the declaration: Rejection will be automatic, without request.
The merchandise did not enter the primary zone or does not have the transport document associated with it after the term of validity of the transmitted export declaration has elapsed: Rejection will be automatic, without the need for a request.
The Customs District determines that the merchandise was not exported after the customs declaration was transmitted: Rejection may be requested by the declarant to the District Director or made without his request.

– Causes that generate a fine:

For these causes, the declarant must request the rejection to the District Director:

Errors in the transmission of supporting documents that hinder clearance if taxes have not been paid.
Errors of transmission that generate taxes for an amount greater than that which corresponds to what is imported.
Application of the code of a customs district different from the district where the goods are physically located.

2. The rejection of the declaration due to errors resulting in the payment of lower taxes is prohibited unless a tariff deferral is obtained after the declaration has been transmitted.

In the following link you can review the complete text of the Resolution:

RESOLUTION

Andrea Moya, partner at CorralRosales
amoya@corralrosales.com
+593 2 2544144

Fernanda Inga, senior associate at CorralRosales
finga@corralrosales.com
+593 2 2544144

DISCLAIMER: The previous text has been prepared for informational purposes. CorralRosales is not responsible for any loss or damage caused as a result of having acted or stopped acting based on the information contained in this document. Any additional determined situation requires the specific opinion and concept of the firm.

CORRALROSALES

Extended responsibility in the management of medicines and pharmaceutical products

7 February, 20247 February, 2024

By Ministerial Agreement No. MAATE-2023-134, issued on November 22, 2023, and published in the Official Registry No. 490 on February 1, 2024, the Ministry of Environment, Water, and Ecological Transition issued the Technical Standard for the Implementation of the Extended Responsibility Principle in the Comprehensive Management of Medicines and Pharmaceutical Products (hereinafter referred to as the Standard).

The Standard applies to any entity engaged in the production, import, and initial placement on the national market. The term “initial placement on the market” refers to the introduction of medicines and pharmaceutical products into the market through any means, including national sale or donation through electronic or remote methods, i.e., when they are first distributed in the Ecuadorian territory.

Non-hazardous medicines and pharmaceutical products are excluded, as determined by the National Health Authority, as well as medical devices.

The main obligations of the producers are as follows:

Obtain the environmental administrative authorization for the manufacturing, storage, and transportation of medicines or pharmaceutical products.
Obtain the registration as a hazardous and/or special waste generator for medicines and pharmaceutical products that are out of specifications or expired within the scope of the producer’s extended responsibility and update it in case of any changes.
Develop and submit, individually or collectively, a Comprehensive Management Program (“CMP”). Report compliance with actions and goals established in the CMP in the first 10 days of March each year.
Inform the National Environmental Authority of emergency events, accidents, and incidents involving expired or out-of-specification medicines and pharmaceutical products within one (1) day of the occurrence, using any official means.

The main obligations of the distributors are:

Implement the CMP.
Deliver expired or out-of-specification medicines or pharmaceutical products to authorized waste managers.
Inform the Producer, within one (1) day of the occurrence of emergency events, accidents, and incidents involving expired or out-of-specification medicines and pharmaceutical products; and,
Provide the consumers with areas for the installation of collection points, equipped with measures for the safe handling and disposal of medicines and pharmaceutical products that are out of specifications or expired.

The CMP will have a validity of 5 years and must ensure that the management of expired or out-of-specification medicines is carried out in a technically sound manner with the lowest possible risk, incorporating gradual collection goals.

Rafael Serrano, partner at CorralRosales
rserrano@corralrosales.com
+593 2 2544144

DISCLAIMER: The previous text has been prepared for informational purposes. CorralRosales is not responsible for any loss or damage caused as a result of having acted or stopped acting based on the information contained in this document. Any additional determined situation requires the specific opinion and concept of the firm.

CORRALROSALES

Organic Law for salary equality between men and women

7 February, 20247 February, 2024

On January 18, 2024, the National Assembly issued the Organic Law for Equal Pay between Men and Women, hereby the “Law”, published in the Supplement to the Official Gazette No. 481 of January 19, 2024, of which we highlight the following:

Its objective is to guarantee equal remuneration and any other form of economic retribution between men and women.
It establishes guidelines to determine that the work rendered is of equal value and obeys objective factors related to performance, competence, and qualifications, working conditions, effort, and responsibility.
It imposes the following obligations on employers:a) To continuously train their personnel both men and women in labor rights. These trainings will be registered and controlled by the Labor Authority.

b) To report annually the actions oriented to achieve equal remuneration, which will be certified by the Labor Authority.

The employers may denounce the non-compliance of their rights to equal remuneration, which must be answered by the employer in detail within a term of 15 days.
If in a complaint process the violation of the right to equal remuneration is verified, the employer must make the payment corresponding to the difference in remuneration with retroactive effect and establish a new remuneration.
Failure to comply with the obligations established by the Law will result in a penalty.

Edmundo Ramos, partner at CorralRosales
eramos@corralrosales.com
+593 2 2544144

DISCLAIMER: The previous text has been prepared for informational purposes. CorralRosales is not responsible for any loss or damage caused as a result of having acted or stopped acting based on the information contained in this document. Any additional determined situation requires the specific opinion and concept of the firm.

CORRALROSALES

Guidelines for the Registration of Equity Plans

30 January, 2024

By Ministerial Agreement No. MDT-2024-013 subscribed on January 19, 2024, the Ministry of Labor issued the following guidelines for the registration of Equity Plans:

The Ministry of Labor will provide a certificate of registration of the Equity Plan, hereby the “Plan”.
The employer has the obligation to disseminate and socialize the Plan with its employees for its effective compliance.
If the Plan should be renewed due to one of the causes established for its mandatory renewal, it must include the reason for the review and update.
Failure to register the Plan may be reported to the Regional Directorate of Labor and Public Service.
The “Equity Plan” will be valid for 4 years from the date of registration before the Ministry of Labor. Once the registration period has expired, the employer must carry out a new diagnosis of the situation.
Failure to comply with the obligation to register the Plan will result in a sanction.
The registration of Plans must be made from January 20, 2024, to July 31, 2024.

The Agreement is in force since its signing date regardless of its publication in the Official Gazette.

Edmundo Ramos, Partner at CorralRosales
eramos@corralrosales.com
+593 2 2544144

DISCLAIMER: The previous text has been prepared for informational purposes. CorralRosales is not responsible for any loss or damage caused as a result of having acted or stopped acting based on the information contained in this document. Any additional determined situation requires the specific opinion and concept of the firm.

CORRALROSALES

Self-Withholding – Large Taxpayers

16 January, 2024

On January 12, 2024, the Internal Revenue Service issued Resolution NAC-DGERCGC24-00000003 which regulates the income tax self-withholding regime applicable for large taxpayers.

For calculating the self-withholding amount, all taxable income must be considered except:

1. Revenue subject to special income tax regimes,

2. Revenue subject to another self-withholding regime established by law, and

3. Revenue derived from the following sources:

a.   Contracts for the provision of services for the exploration and exploitation of hydrocarbons if the payment is made by the Ecuadorian Government,
b.   Contracts with the central government and its entities,
c.   Contracts with local governments and its entities; and
d.   Contracts with Government social security entities.

If the taxable income cannot be segregated from exempt income, the self-withholding must be calculated over the total income received monthly.

Large Taxpayers must issue a withholding certificate monthly. The self-withholding percentage applicable to each taxpayer can be reviewed at the following link:
LINK

Andrea Moya, Partner at CorralRosales
amoya@corralrosales.com
+593 2 2544144

DISCLAIMER: The previous text has been prepared for informational purposes. CorralRosales is not responsible for any loss or damage caused as a result of having acted or stopped acting based on the information contained in this document. Any additional determined situation requires the specific opinion and concept of the firm.

CORRALROSALES

Law on Energy Competitiveness

15 January, 202415 January, 2024

The Law on Energy Competitiveness (“LOCE”) was published in the Second Supplement of the Official Registry on January 11, 2024. Below, we summarize the most important energy and tax matters:

1. Projects included in the Master Plan for Electricity (“PME”) may be delegated to private entities through public selection processes in the following cases:

a. When it is necessary to meet the public interest, or
b. When the service cannot be provided by entities wholly or partially owned by the Government, according to the needs of the electric system.

2. Projects not included in the PME based on unconventional renewable energies that have been identified by the private sector may be delegated to their promoter if the project does not exceed 10MW in power. Larger projects must be delegated through a public selection process, and benefits will be recognized for the promoter’s participation.

3. The construction, operation, and maintenance of public lighting systems may be delegated to private companies.

4. All projects delegated to the private sector must be developed by companies established in Ecuador.

5. The delegation to the private sector of existing infrastructures financed with the General State Budget is prohibited. Entities wholly or partially owned by the Government Public shall be responsible for managing such infrastructures.

6. Private entities may build new networks and distribution infrastructure to supply electricity for commercial and industrial clients isolated from the electric distribution grid. Expenses incurred for this purpose will be considered deductible for calculating the applicable income.

7. Regulated and non-regulated consumers may install distributed generation systems for self-supply (“SGDA”). These systems must use unconventional renewable energies and can be owned by the consumer or a third party.

The depreciation and amortization value of the equipment, and technology acquired for SGDA implementation will be deductible with an additional 100% for income tax purposes.

8. Energy block transactions may be conducted through the sale of energy via contracts signed by participants in the electric sector or through short-term transactions.

9. Clients who make payments for public electricity and lighting services until June 30, 2024, will not be subject to interest payments. Clients located in Manabí and Esmeraldas will not be subject to paying any amount due for the services received during the state of emergency caused by the 2016 earthquake. These benefits do not apply to industrial clients.

10. Other tax regime amendments include:

a. 0% VAT rate will apply to the transfer of equipment and accessories for solar photovoltaic generation and wastewater treatment plants.

b. Electric vehicles are described as those propelled solely by electric power sources, with batteries charged exclusively using this type of energy and that produce zero direct polluting emissions. Electric vehicles shall not be understood as those that have self-generation systems with an internal combustion source.

c. The remission regime is amended, payment must be made by July 31, 2024.

d. The Foreign Trade Committee (COMEX) shall tax agricultural machinery that works with clean energy sources with a 0% tariff. This amendment must be carried out until May 10, 2024.

e. Payments made abroad by private financial institutions for credits and financial returns from fixed-term deposits or investments, will not be exempt from the payment of Outflow Tax (ISD) until January 11, 2025.

The President of the Republic must issue the applicable regulations by February 10, 2024.

Carlos Torres, Senior Associate at CorralRosales
ctorres@corralrosales.com
+593 2 2544144

Mario Fernández, Associate at CorralRosales
mfernandez@corralrosales.com
+593 2 2544144

DISCLAIMER: The previous text has been prepared for informational purposes. CorralRosales is not responsible for any loss or damage caused as a result of having acted or stopped acting based on the information contained in this document. Any additional determined situation requires the specific opinion and concept of the firm.

CORRALROSALES

Suspension of deadlines – Internal Revenue Service

15 January, 2024

On January 10, 2024, the Internal Revenue Service issued Resolution NAC-DGERCGC24-00000001 suspending the terms and deadlines of all tax administrative procedures from January 10 to January 12, 2024, including the latter.

Andrea Moya, Partner at CorralRosales
amoya@corralrosales.com
+593 2 2544144

DISCLAIMER: The previous text has been prepared for informational purposes. CorralRosales is not responsible for any loss or damage caused as a result of having acted or stopped acting based on the information contained in this document. Any additional determined situation requires the specific opinion and concept of the firm.

CORRALROSALES

A conversation with Maria Cecilia Romoleroux, partner at CorralRosales

11 January, 202411 January, 2024

DETAILS

DATE: 01-12-2023

PROFESSIONALS INVOLVED IN THE ARTICLE:

–Maria Cecilia Romoleroux

MEDIA:

– Ekos VIOLETA Magazine

“My law degree and specialization in Intellectual Property were not choices I made, but rather a destiny that chose me.”

It was with these words that María Cecilia Romoleroux —recognized through multiple international awards and appointments, including the Chambers Women in Law Awards— dove into an exclusive conversation with Ekos Violeta Magazine.

Her journey in the legal world began when a family member, surprisingly and without consulting with her, enrolled her in law school. At the time, she could never have imagined that she would become a distinguished attorney with a career spanning more than three decades.

Maria Cecilia’s story begins in the 1990s when, at the age of 20, started an intellectual property practice with a friend and fell in love with intellectual property. However, as so often happens in life, challenges arose, and Maria Cecilia experienced difficult times that included harassment and discrimination, which ended up triggering her decision to find her way in the profession. Although it was a rocky path, she never doubted that her potential would lead her to break glass ceilings.

“At the age of 24, young and afraid, I decided to seek my independence and not stand idly by in a world that often resists women having prominent roles,” she said. Although some people frowned at her way forward, Maria Cecilia leaped into the unknown, not knowing what awaited her, but always confident of herself.

More than two decades ago, María Cecilia first began working at the CorralRosales law firm and contributed to its growth, demonstrating that women can reach high positions in the legal world.

Impactful Strategies

From her position as a firm partner, she has implemented programs and workshops to promote gender equality and empower women. One of them is the Entrepreneur Program, which seeks to support new ideas and business models, launched by entrepreneurs, that contribute to the dynamization of the Ecuadorian business ecosystem. The program pays special attention to initiatives generated by female talent, minority groups, and the LGTBQ+ community. Support is provided to them through the firm’s pro-bono program and specialized legal counsel with preferential conditions.

Maria Cecilia has not only achieved her own personal success, but also advocates to empower future generations. “I have always had a special focus on social facets because for me, the right thing to do is pave the way and work to make things easier for other young women and future generations, generating a new reality, one with fewer obstacles to overcome,” she says.

She concludes with a powerful piece of advice: “The world has evolved, and there is no turning back. We need to educate and train ourselves, trust ourselves, and change our mentality. We women are not victims, and we can be the protagonists of our lives.

Maria Cecilia’s story reminds us that, with determination and self-confidence, it is possible to reach heights and positions traditionally thought to be reserved for.