An article of The Economist named The world’s most valuable resource is no longer oil, but data rightly brought up in 2017 that data, as a new commodity that spawns a lucrative industry, prompts antitrust regulators to step in to restrain those who control its flow.[1]
Moreover, the rapid increase of social media platforms and their users has given place to security concerns on how users’ data is handled. The most recent and controversial case involves the short-form video platform TikTok, which the authorities of the United States fear is feeding data directly to the Chinese Communist Party (e.g. their facial recognition patterns, information about their residence, their phone numbers, their friends, who they are connected to).[2]
In addition to the concerns about how people’s data is handled and the security issues that may arise; legal provisions aiming to fight the spread of the COVID-19 pandemic have aroused several questions among companies regarding the type of health-related information they can request to their employees, how such information should be stored, and what risks could arise if not handled properly.
In Guatemala, among the several legal provisions that have been enacted, there is one that provides the criteria for the different type of establishments or buildings to open to the public and that regulate workspaces, stating that, in some cases, people that are over the age of 60 years old and people that are considered of “high risk” shall work from home or in special conditions.[3] Another legal provision gives the list of the medical conditions to consider a person of “high-risk”.[4] To comply with such norms, employers must ask their employees personal information, such as medical conditions. Could there be any potential issue or risk for having such information stored in the company’s records? What role does the right to privacy play?
The right to privacy, in simple terms, is the right of a person to be free from intrusion intro or publicity concerning matters of a personal nature;[5] and although it is not expressly recognized in the Political Constitution of the Republic of Guatemala, the Constitution does provide a specific protection for the Inviolability of correspondence documents and books, recognizing and protecting the intimacy of persons.[6] Moreover, the Republic of Guatemala is part of several international treaties and conventions in which the right of privacy is expressly recognized and protected (e.g. the United Nations Declaration of Human Rights and the International Covenant on Civil and Political Rights).
While the right of privacy is the right of every person to be free from interference or intrusion, Data Privacy the right of a citizen to have control over what sort of information about themselves is collected and how it is used.[7] Thus, practical data privacy concerns often revolve around: i) whether or how data is shared with third parties; ii) how data is legally collected or stored; and iii) regulatory restrictions.[8]
The Constitutional Court of Guatemala has developed jurisprudence regarding the consent that is needed from persons when it comes to compiling and commercializing their data,[9] stating that the person whose personal information is been commercialized must provide express consent to that end, and that the database and the use of the personal information have to be under adequate control methods that allow the verification of the information, the possibility to update this information, and the right to rectify any information in case there is improper use of the information.
In addition to the Constitutional protection for the Inviolability of correspondence documents and books, the Access to Public Information Act protects people’s data. The Act has the specific purpose of guaranteeing the right of every person to know and protect its personal information contained in the files of governmental agencies, registries and offices, and public and private entities that receive public funds. Moreover, it provides definitions such as personal data and sensitive data or sensitive personal data (among which is considered the persons’ medical conditions). It also typifies as a crime the commercialization, distribution of individuals information files, sensible data or personal data without this person’s prior consent.[10]
In a similar vein, the Criminal Code typifies the crime of Prohibited Registries as the creation of databases or an informatics registry with data that may violate individual’s privacy;[11] and the crime of Use of Information as using or accessing the computer records, data, files or databases of another person without its authorization.[12]
Furthermore, the Health Code of Guatemala protects personal health information, establishing that “all inhabitants have, regarding their health, the right of respect to their person, dignity and intimacy, as well as to professional secrecy and to be informed in comprehensive terms about health risks, illness and the services they have right to.”[13]
Finally, the Superintendency of Banks also provides specific restrictions and obligations to the Financial Institutions it supervises, regarding the protection and not commercialization of their users’ data.
As it was initially stated, data privacy comes from the human right to privacy, and although it is not extensively and thoroughly regulated in Guatemala, the protection to people’s data is being developed in several laws and case-law. Public authorities have been increasingly concerned about it, bringing cases to courts.[14]
The pandemic has brought not only new ways of working and interacting with others, but also new challenges for employers, being one of them how to properly store and handle the personal data (e.g. medical conditions) of their employees, ensuring that it will be kept in strict confidentiality, that it will not be commercialized or distributed, and that no form of discrimination is going to arise from it.
- https://www.economist.com/leaders/2017/05/06/the-worlds-most-valuable-resource-is-no-longer-oil-but-data?fsrc=scn%2Ftw%2Fte%2Frfd%2Fpe
- https://www.theguardian.com/technology/2020/aug/03/tiktok-row-trump-to-take-action-soon-says-pompeo-as-microsoft-pursues-deal
- See Ministry of Health Agreement no. 187-2020
- See Ministry of Health Agreement no. 146-2020
- https://www.merriam-webster.com/legal/right%20of%20privacy
- See article 24 of the Political Constitution of the Republic of Guatemala.
- https://www.law.cornell.edu/wex/personal_information
- https://www.varonis.com/blog/data-privacy/
- See files no. 1356-2006, 863-2011, and 3552-2014.
- Article 64 of the Access to Public Information Act.
- Article 274 D of the Criminal Code of Guatemala
- Article 274 F of the Criminal Code of Guatemala
- Article 6 of the Health Code of Guatemala
- One example is a recent case that was taken to court by the Ombudsman for Human Rights against a company that was compiling and commercializing people’s personal data. On July 15, 2020, the Civil Court that was in charge of the case sanctioned the company and sent the case to the Attorney’s General Office for the corresponding criminal investigation. See Amparo 01161-2013-00084 Eleventh Court of First Instance of the Department of Guatemala
