On February 2nd, 2024, Resolution No. 38/2024 of the Agency for Access to Public Information (the “Agency”) was published in the Official Gazette. This Resolution modified the design of the template sign that entities must place in their places of business to comply with their duty to inform the public of the existence of security cameras, also known as CCTV.

Below, we offer some details regarding this activity provided by the Personal Data Protection Law and Provision No. 10/2015 of the National Directorate for the Protection of Personal Data (the “Provision”):

Consent and duty of information

The Provision states that the collection of images within a place of business and its premises does not require the consent of data subjects (meaning people that may be filmed by devices such as CCTV) as long as such filming does not involve a disproportionate intrusion into their privacy and does not invade public or private space, unless, this is an unavoidable consequence.

In addition, entities must comply with the duty to inform data subjects under the Personal Data Protection Law, which can be implemented through signs such as the template sign mentioned above.

Signs should clearly indicate to the public:

The existence of the security devices (such as CCTV), without being necessary to identify their location.
The purpose(s) for which the images are captured.
The data controller (meaning the entity that is responsible for the video surveillance cameras and that takes the images for security purposes), its address and its contact details for the exercise of rights by the data subject.

Below is the new template sign proposed by the Agency.

B.

Limitations on the use of video surveillance devices

The Provision also contains some limitations to image recordings, in order to safeguard the right to privacy of the data subjects:

Images obtained through video surveillance devices may only be used for the purposes for which they were collected and informed to the public, and not for purposes different or incompatible with those for which they were collected.
Video surveillance devices should not be installed in “inappropriate” areas.  That is, places where the intrusion into people’s privacy would be disproportionate, such as toilets.

Identity validation technologies

In the event that the entity has video surveillance devices that incorporate technologies that allow to validate the identity of its collaborators to control their access to its place of business, it should consider that this implies a processing of biometric data that is under scrutiny in jurisdictions with more advanced  data protection legislation. It cannot be ruled out that an eventual legislative reform in Argentina would entail the need to review the proportionality of this kinds of practices on a case-by-case basis and, if necessary, replace them for mechanisms that are less invasive for the data subjects.

Registration of video surveillance databases

Finally, the Provision reminds entities that they must register video surveillance databases. To this end, they are required to draft and submit to the Agency a Data Processing Manual, which must contain at least the following information:

means by which the images will be collected, 
reference to the locations and schedules at which the collection is expected to take place,
period in which the images will be stored, 
security and confidentiality measures in place to protect the data subjects’ information,
measures provided for complying with the data subject’s rights.

If your organization needs advice on registering databases in Argentina,  drafting of data processing manuals,  placement of signs directed to data subjects, or personal data processing policies, do not hesitate to contact info@lermanszlak.com.

Sofía Orlinsky

Luciano Gutman T° 145 F° 535 C.P.A.C.F.