The Bill is a response to the need to ensure individual privacy, so that third parties may not impinge on that right. It covers issues relating to storage, interoperability, intelligence and analytical applications and digital information processing.

The bill is structured as follows:

Purpose

• To ensure respect and protection of fundamental rights, civil liberties and other associated legal assets.
• To safeguard and guarantee Panamanian citizens’ basic right to personal data protection.
• To establish regulations covering the processing, automated or not, of personal data.
• To provide citizens with an overarching legal instrument for their protection and defence.  

Scope of regulation

• Natural and legal persons in the state and private sectors, non-profit and for profit organisations, involved in personal data processing and/or custody.

Exemptions

• Natural persons who handle domestic data only.  
• Data agencies with credit histories of consumers: banking, insurance and other customers.
• Competent authorities working to prevent, investigate, detect or bring to trial criminal actions, or those enforcing criminal penalties.
• Subjects whose data is being processed for the purpose of financial intelligence analysis or relative to national security, in compliance with international law, treaties or conventions regulating these areas.  
• Subjects whose information has previously been dissociated or anonymised, such that the conclusion cannot be traced to the personal data holder.
• Those regulated under special laws.  

Domestic and international storage

• Data bases on Panamanian territory: all databases containing data of critical national importance must be physically housed on Republic of Panama territory.
• Data bases outside Panama: data may be transferred abroad, provided that the company and/or residing country has comparable standards of protection to those in this bill.
• The preceding clause will not affect data transfer: if the data owner has given permission, in the case of transfers between banks, money transfers, or between stock exchanges, of information which must be transmitted by law or under international treaties ratified by the Republic of Panama   or when the transfer is necessary in order to enforce an existing contract, one about to be agreed by the data owner, or in the interest of said titleholder.

Sanctions

• These will be levied progressively depending on the severity (mild, serious and very serious) and on the repeated commission of the infraction.
• They will have the following categories: verbal warning, written warning, fines or closure of the database.

Presentation in the National Assembly

• After approval from the Cabinet, the Minister for the Presidency of Panama, Álvaro Alemán, presented the above bill to the National Assembly on 9th February 2017.

Entry into law

• The National Assembly is currently debating the bill. If passed at the Third Hearing, it will be termed the Personal Data Protection Law and come into force one year after publication in the Official Gazette.