With the enactment of Law No. 81 on Protection of Personal Data, the Republic of Panama aims to establish the principles, rights, obligations and procedures that regulate the protection of personal data, also considering their interrelation with private life and other rights and fundamental freedoms of citizens, by natural or legal persons, public or private law, lucrative or not, that process personal data in the terms provided in the Law.
Storage or transfer of personal data:
The storage or transfer of personal data of a confidential, sensitive or restricted nature, outside the territory of Panama, by the company responsible for the storage of data or custody thereof, will be allowed, provided that the company and/or country of residence have standards of protection comparable to those of the Law or if the entity that transfers the data makes sure to adopt all the necessary steps so that it is protected. The following cases are excepted from the aforementioned requirements: (1) when the owner has granted its consent for the transfer; (2)when the transfer is necessary for the execution or enforcement of a contract by the interested party; (3) in cases of bank or money or stock exchange transfers; and (4) in case of information whose transmission is required by law or in compliance with international treaties ratified by Panama.
It establishes the obligation to develop procedures, protocols and processes for the management and transfer of data that includes the appropriate security methods.
Consent of the owner of personal data:
It is established that the processing of personal data can only take place as permitted in this Law, or with the consent of the owner of the data.
Definition of sensitive data:
Sensitive data refers to the private sphere of its owner or whose misuse could give rise to discrimination or entail a serious risk for him/her- for example, of racial origin, religious beliefs, union affiliation, political opinions, data related to the health, life, preference or sexual orientation, genetic data or biometric data, among others aimed at uniquely identifying a natural person.
Sensitive data can not be transferred except: (i) by explicit consent of the owner; (ii) when necessary to safeguard the owner's life; (iii) when it is necessary for the recognition, exercise or defense of a right in a judicial proceeding; and (iv) when it has a historical, statistical or scientific purpose.
Rights of Access, Rectification, Cancellation...