Implications of Personal Data Processing in Contractual Matters

What is personal data processing?

The Organic Law on Personal Data Protection (LOPDP) defines processing as any operation consisting of collecting, obtaining, recording, storing, modifying, deleting, distributing personal data, or any use thereof. (Art. 4 LOPDP)

In Ecuador, the competent authority to audit, sanction, and guarantee the protection of citizens’ personal data against potential infractions is the Superintendency of Personal Data Protection. (Art. 76 LOPDP)

Personal data protection clauses in contracts

In commercial, civil, labor, or any other type of contract that involves the management of personal information, including personal data protection clauses is mandatory for data controllers. These clauses must clearly detail the specific purposes of the processing, the data retention period, transfers to third parties (if applicable), and the mechanisms for data subjects to exercise their rights, thereby prohibiting generic authorizations. (Art. 12 LOPDP)

When can personal data be processed?

The processing of personal data is legitimate and lawful 1) by consent of the data owner, 2)  in compliance with a legal obligation of the controller, 3) by judicial order, 4) in compliance with public interest missions, 5) for the execution of pre-contractual measures and contractual obligations, 6) to protect vital interests, 7) to process data contained in accessible publicly databases, 8) to satisfy the legitimate interest of the data controller. (Art. 7 LOPDP)

Regarding contracts, the processing of personal data is usually enabled by the consent of the data owner. It is important to specify that this will expression must be free, specific, informed and unambiguous. (Art. 8 LOPDP)

At Quevedo y Ponce, we provide legal counsel in drafting contracts aligned with the regulations in force in the country and in accordance with personal data protection standards, preventing sanctions from the competent authority.