As part of the cycle of four talks on digital sovereignty in Argentina organized by the Becerra Chair (Convergence Politics, Communication Sciences Program, University of Buenos Aires), Beatriz Busaniche participated in the panel “The Digital Dispute: Updating the Personal Data Law.” The event was designed to go beyond the typical academic classroom dynamic and open high-level technical and political discussions to public debate.
Personal Data Protection Law 25,326 is over 25 years old, having been enacted in 2000. Over this quarter-century, the technological landscape has changed radically: the State has steadily increased the collection of biometric data, enabled the systematic cross-referencing of public databases, and deployed tools such as the digital ID (DNI digital). However, the core legislation remains unchanged. Although there were previous update attempts, such as the bills promoted by the Agency for Access to Public Information (AAIP) in 2018 and 2023, none reached debate in the National Congress.
The immediate trigger for this panel was the drafting of a new reform proposal within the Ministry of Deregulation and State Transformation. To critically analyze this draft, the chair invited specialist Beatriz Busaniche, director of Fundación Vía Libre.
Following an analysis led by Margarita Trovato from Vía Libre, the foundation submitted comments on the draft bill. Far from updating safeguards, the draft dismantles the few existing citizen protection mechanisms against a structural power asymmetry.
Beatriz Busaniche—who spoke in her dual role as a professor in the chair and institutional representative of Fundación Vía Libre—opened her presentation by noting that Law 25,326 “is not necessarily bad just because it is old.” She explained that the 2000 law establishes fundamental rights-guaranteeing principles:
-
Explicit recognition that data ownership belongs to the individual to whom it refers.
-
Guarantee of control and information rights regarding these records.
-
Principle of data minimization.
-
General prohibition of data collection, subject only to two legitimate exceptions: express informed consent or enabling legislation.
However, the draft of the new bill contains several critical points that undermine fundamental citizen rights:
-
International Data Transfers and Bilateral Agreements
-
Artificial Intelligence Training (Opt-in vs. Opt-out)
-
Automated Decision-Making and Profiling
-
Dismantling of the “Torres Abad” Precedent and State Processing
-
Tacit Consent
You can read more about these points in the document “Brief comments on the Draft Personal Data Protection Law of the Ministry of Deregulation and State Transformation” (available in spanish).
Beyond the specific analysis of the draft bill, it is crucial to emphasize that the effectiveness of any personal data regulatory framework relies on an enforcement authority with functional autonomy, an adequate budget, and technical auditing capabilities, independent from both the Executive Branch and the private sector.
You can access the recording of the event on YouTube: