Tag Archives: Personal data protection

Resolution No. SPDP-SPDP-2024-0002-R (“Resolution”), published in the Official Gazette No. 640 on September 10, 2024, the Data Protection Authority (“SPDP” or “Authority”) issued the “Mandatory Technical Guide for the Registration of the Attorney-in-fact designated by Controllers, whether acting individually or jointly, and Processors that engage in Data Processing Activities in the Republic of Ecuador” (“Guide”).

The following are highlighted:

1. The Guide is mandatory for all controllers and processors who, although not domiciled in Ecuador, offer goods or services to residents of the country, are part of the personal data protection system, or control the behavior of data subjects to the extent that such control occurs within the territory (“Regulated Entities”).
2. The Regulated Entities must designate an attorney-in-fact (“Attorney-in-fact”) on a permanent basis. The Attorney-in-fact must be vested with broad faculties to represent them before administrative and judicial bodies on data protection matters. In addition, the Attorney-in-fact must handle requests or complaints from data subjects without limitations that could affect their rights.
3. The power of attorney must detail the commercial name and the brands identifying the foreign controller in the market. Foreign processors must also detail information regarding the controllers for whom they process data. Both controllers and processors must provide their addresses and telephone numbers for their offices and those of their Attorney-in-fact designated in Ecuador.
4. In case of non-compliance with these obligations, the individuals or entities who, under certain circumstances, appear to act on behalf of the Regulated Entities may be held administratively liable. The Authority may impose and apply corrective measures established in the Data Protection Law and its Regulations.
5. The Attorney-in-fact can be an individual or a legal entity domiciled in Ecuador. If the Attorney-in-fact is an individual, they must be Ecuadorian or, if foreign, a resident in the country with full political rights. When the Attorney-in-fact is an entity, its corporate purpose must allow it to act as Attorney-in-fact. The SPDP may verify with the Superintendence of Companies that the entity meets its obligations, and that the appointment of the legal representative is valid.
6. Regulated entities must register their Attorney-in-fact with the SPDP by presenting the document granting the power of attorney. If the power of attorney is granted abroad, it must be apostilled or certified by an Ecuadorian diplomatic agent. Powers of attorney in a foreign language must be translated into Spanish.
7. The SPDP will verify that the power of the Attorney-in-fact meets the Guide’s requirements and assess whether the power of attorney granted is adequate and sufficient. If it is approved, registration will proceed, and the Regulated Entity will be notified. The registration of the Attorney-in-fact, along with their contact details, will be published on the SPDP’s website and that of the Regulated Entities to facilitate the exercise of data subjects’ rights.
8. The Regulated Entities must update their Attorney-in-fact registration in the following cases: a) death; b) resignation; c) expiration of the power of attorney, if applicable; d) change in the denomination, absorption, split, transformation, dissolution, or liquidation of the entity designated as the Attorney-in-fact. Except for the death of the Attorney-in-fact, the registered Attorney-in-fact will continue to be liable before the SPDP and the data subjects until the registration is updated.
9. All controllers and processors performing data processing abroad must present the following to the Authority:

• • The co-responsibility or data processing agreement.
  • The Record of Processing Activities (ROPA).
  • Risk analysis for each processing activity.
  • Dataflow of personal data for each processing activity.
  • Security measures implemented for data transfers.
  • Self-regulation codes, if any, must be approved by the Authority.

Transitional provisions of the Resolution establish the following:

1. Regulated Entities engaged in processing activities since September 6, 2024, are granted a six-month period from the issuance of the Guide to comply with the registration of their Attorney-in-fact.
2. The Authority will initiate the corresponding administrative control processes if an Attorney-in-fact is not registered within the period.
3. The application for registration of the Attorney-in-fact must be submitted in person at the Authority’s office.

 

Resolution No. SPDP-SPDP-2024-0001-R introduces the Organic Statute of Organizational Management by Start-up Processes in the SPDP, hereinafter referred to as the “Statute”. This Resolution, effective as of August 2, 2024, establishes the basis for efficient and transparent management of the Institution.

What are the key aspects of the Statute?

Flexibility in Structure The Statute allows for future modifications in processes, products, and administrative units according to implementation and deconcentration needs. Process Management The SPDP will optimize its activities and resources, focusing on achieving its goals more efficiently and effectively. Managerial Positions The Quartermasters, General Coordinators and Directors are freely appointed and removable. Continuous Improvement Continuous evaluation and improvement of processes is promoted, ensuring adaptation to changes and the pursuit of excellence in management. Transparency Management by processes will facilitate access to information and accountability, strengthening institutional transparency. Demand for Services and Products The Financial Administrative Directorate shall submit a report detailing the services and products that the SPDP will need within 180 days. The corresponding authorities must approve this report.

What does the approval of the Statute imply?

Approval of the Statutes implies that the SPDP can perform its role as a technical supervisory, audit, intervention, and control body. This includes issuing decisions, monitoring compliance with the law, investigating complaints and applying sanctions in the event of non-compliance.

What is the organizational structure?

The organizational structure is divided into three processes:

• Governing Processes: They are responsible for the direction and control of the institution, establishing guidelines, policies, and strategic plans.
• Substantive Processes: They conduct the essential activities to provide services and fulfill the SPDP’s mission, such as the supervision, regulation, and control of the processing of personal data.
• Adjective Processes: Provide support to the other processes, including legal advice, planning, and administrative and financial management.

In summary, the structure is divided as follows:

Type of Process Level Unit Responsible Governance Management Strategic Management Superintendent for the Protection of Personal Data Substantive Operational General Intendancy for Technological Innovation and Personal Data Security General General Intendant for Technological Innovation and Personal Data Security General Substantive Operational General Intendancy for the Regulation of Personal Data Protection General Intendant for the Regulation of Personal Data Protection Substantive Operational General Intendancy for Control and Sanctions General Intendant for Control and Sanctions Adjectives Advisory Directorate of Legal Advisory Services Director of Legal Advisory Services Adjectives Advisory Planning and Strategic Management Unit Planning and Strategic Management Specialist Adjectives Support Financial Administrative Management Financial Administrative Director

In conclusion, the approval of the Organic Statute of the Superintendence of Personal Data Protection marks a crucial milestone in data protection in Ecuador. From now on, the SPDP has the necessary structure and mechanisms to ensure compliance with the Organic Law on Personal Data Protection and its Regulations. This means that companies must comply, diligent and transparent in the handling of personal information, thus guaranteeing the privacy and security of the data of their clients, employees, and users.

 

On March 28, 2024, the Council of Citizen Participation and Social Control (CPCCS) appointed Fabrizio Roberto Peralta Díaz as the Data Protection Authority for 2024-2029.

During the presentation of his work plan, Mr. Peralta highlighted his experience in data protection and proposed the following:

i.    Implement an educational vision in the Authority.

ii.    Generate inter-institutional relations by creating awareness of administrative, legal, and technical security measures related to data protection.

iii.    Create technical dependencies responsible for registration, policy planning, and sanctions.

iv.    Promote prevention, protection, and transparency as fundamental principles.

v.    Ensure the appropriate use of resources under the Transparency and Access to Information Law.

The CPCCS must submit the resolution designating the Data Protection Authority to the Legislative for his possession.

 

Rafael Serrano, partner at CorralRosales
rserrano@corralrosales.com
+593 2 2544144