In April, the international organization Access Now, working with the Internet Bolivia Foundation, drew up a set of Personal Data Protection guidelines containing basic definitions of terms and subjects, together with an explanation of the current legal framework in Bolivia.

The guidelines aim to create awareness about the importance of data protection and for it to be considered an indispensable aspect of using and making the most of technology within a context of protecting human rights. The document covers the following areas:

Definitions and basic concepts

The guidelines go over the basic notions behind personal data. They explain the different types of personal data, the ways in which they are processed (together with the officers and supervisors in charge of this), and how the data and rights of the title owners are protected: the right to information, right of access, of rectification, of consent or withdrawal of consent, the right to suppress data, the right to be forgotten, to oppose, of transfer and of explanation.

Situation in Bolivia

Bolivia, together with Paraguay and Ecuador, is one of the countries in Latin America that does not yet have overarching, comprehensive personal data protection legislation. This said, there are provisions in the different legal bodies on the matter:

• Constitution: the constitution recognizes the right to privacy, intimacy, honor, to one’s own image and dignity. It also makes provisions for “Action to protect one’s privacy” which the Bolivians may exercise when they are unable to find out what information has been filed in a data bank, nor request its elimination nor correct it.
• The General Telecommunications, Information & Communication Technology Act: this sector-specific law recognizes the right of user to privacy and the right to decide on the data that telephone directories will contain. The law’s secondary regulations, when referring to the digital certificate, grant the individual a framework of control over their data, since they must give their consent before the data can be used.
• Digital citizenship Act: the regulation stipulates that personal data processing must be limited to the purpose laid out in law.

In view of this situation, the need to drive forward a personal data protection law is clear. Grouping together into one law all the areas covered in several laws spanning quite different sectors will provide the security mechanisms required for effective protection.