Resolution No. 2020-69 of the Agency of Access to Public Information.
CIRCULAR
Data Privacy & Data Protection Department report | Resolution No. 2020-69 of the Agency of Access to Public Information
Dear Sir or Madam,
On April 13th, 2020, the Agency of Access to Public Information (AAPI), the enforcement authority of the Data Protection Law No. 25,326 (hereinafter, the “DP Law”) decided by means of Resolution No. 2020-69 (the “Resolution”): (i) to impose a fine on Google Argentina S.R.L. (“Google Argentina”) for having incurred in a serious infringement to the DPA by not properly handling and dealing with a request of the right of access to information exercised by a user of the Gmail service in accordance with the provisions of Section 14 DPL and (ii) to impose a fine on Google Argentina and Google LLC. (“Google LLC”) for the commission of a very serious infringement consisting on carrying out maneuvers tending to withdraw or impede the development of the controlling activity by the AAPI.
The Resolution issued by the AAPI was based on the following grounds:
• DP Law − Imperative rule of public order − Extraterritorial application. By means of the Resolution, the AAIP emphasized that the DP Law contains provisions that are imperative rules of public order that apply to the entire territory of the Argentine Republic (according to Section 44 DPL). Additionally, the Resolution reasserts that the AAPI and the federal courts have jurisdiction throughout the country over those databases’ controllers responsible for interconnected databases that have inter-jurisdictional, national or international scope, to the extent that data from Argentine data subjects is processed or that, in any other way, the treatment of data connects with, or produces effects in, in the Argentine Republic (by interpreting Section 26.b of the DP Law).
• Google LLC’s acknowledgment with respect to the mandatory application of the DPL and Argentine jurisdiction. It was highlighted that Google LLC did not challenge the jurisdiction of the Argentine federal courts nor the mandatory application of the DP Law but only challenged the competence and authority of the AAPI. In this regard, Google LLC opposed the AAPI’s requirement arguing that a court order issued by a competent court should relieve Google LLC of its confidentiality obligation under DP Law.
• Disregard of the Wrong Entity Argument. Economic interdependence. Google Argentina declared to be a commercial agent of Google LLC. The AAIP held Google Argentina liable with regard to the administration of the Gmail service provided by Google LLC as a related company and recognized Google Argentina’ passive procedural standing in the complaint and action filed, due to the economic interdependence between the two companies. In this regard, the AAIP indicated that the advertising services provided by Google Argentina – as Google’s commercial agent in our country–, which operate as platforms for advertisements or as tools to extract personal data from users that facilitate advertising microtargeting and make the collection and processing of personal data carried out by Google LLC profitable, are strictly related to the services provided by Google LLC and depend on their existence and availability.
• Notice and Summons to Google LLC in Google Argentina’s domicile. The AAPI indicated that Google Argentina – that operates as a commercial agent- represents Google LLC within the territory of the Argentine Republic for the purposes of its notification and location in the procedure.
• Data Subject’s rights. The AAIP concluded that none of Google’s arguments were sufficient to prove an exception to the right of access. Also, it was stated that the DP Law prescribes that the personal data should be stored in a way that allows the exercise of the right of access of the data subject, so it was considered inadmissible that Google Argentina did not deal with a request of access referring the claim to Google LLC located in the United States.
Likewise, it was considered unacceptable that Google LLC does not contemplate alternative mechanisms to the standard mechanism that is available on its website for the recovery of account or information since – both, Google Argentina and Google LLC-, were in a position to provide additional technical assistance either at their offices in the Buenos Aires or through some telecommunication mechanism.
Should you require any further information on this matter, please do not hesitate to contact us.
Sincerely,
Emilio Beccar Varela
Florencia Rosati