Personal data: what changes with the Court’s ruling that limits its use by the State

According to the “Torres Abad” case, which he was able to access Clariona retiree sued the state to prevent his telephone and email, delivered to ANSES, from being transferred to another state agency and used for another purpose. She maintained that these data had been delivered to the entity for a specific objective, linked to their pension situation, and that he did not consent to its use for other purposes.

The plaintiff also maintained that this situation exposed her to inconvenience, loss of time and a state of unease, especially due to her condition as an older adult. The highest court cites in the document the right to tranquility, solitude and “right to be left alone.”

“It is the right to enjoy solitude without being disturbed by unjustified intrusions. The Court pointed out that the telephone and email are the channels through which someone can disrupt daily life and, if that information was transferred without consent, it is something that the owner did not authorize. For the Court, this potential disturbance is enough to violate the right to privacy,” Luis García Balcarce, a lawyer specialized in digital rights, explains to this medium.

The Court held that, when it comes to personal datathe consent of the owner has constitutional support. The basis of this interpretation is in articles 19 and 43 of the National Constitution: the first protects privacy and individual autonomy, while the second incorporates the have data as a tool for “know, control, rectify, update or demand confidentiality” about personal information. The case applies to the plaintiff, Torres Abad, but sets a precedent for any citizen who opts for judicial avenues.

“What the plaintiff wanted to preserve was that the State did not contact her without her authorization. She had given her telephone number and email to collect her retirement, not to receive calls or emails from the Government. The Court confirmed that there was no need to wait for them to call herbecause the transfer of your data without consent for a purpose other than that for which you had provided it was, in itself, the violation of the right”says García Balcarce.

“The Court first recognized that the personal data protection law, applicable to the case, allowed, as an exception, the transfer of data between State agencies. But he later declared those articles unconstitutional. The argument is that the exceptions were so broad that they included almost all state activity and, an exception that covers everything, empties the constitutional protection of privacy of its content,” he reflects.

For this reason, the failure unites two dimensions that are usually treated separately: the protection of personal data and the right to privacy. For the highest court of Justice, the case was not limited to an administrative discussion about whether two organizations could exchange information, but to the ability of a citizen to decide for what purpose they give their data, who can use it and to what extent.

“The general principle is consentwhich is always for a particular purpose. If the information is going to be used for something else, you have to request it again,” Margarita Trovato, lawyer and member of the Vía Libre Foundation, explains to this medium.

“The violation of privacy does not have to be exposing my correspondence or having my phone tapped. It also has to do with tranquility, solitude and autonomy,” says Trovato, referring to the right cited in the ruling.

The Court used the idea of “informational self-determination”that is, the right of each owner to control the use of data that identifies him or her or allows us to contact him. Trovato explained it like this: “It is the idea of ​​knowing who has my data, what it is being used for and eventually being able to object and correct it.”

The Court also stressed that the Telephone and email have a particular sensitivity. Although they are not intimate data, they allow us to enter daily life through calls or messages.

The ruling was signed by Court judges Horacio Rosatti and Ricardo Lorenzetti, along with co-judge Daniel Bejas. In dissent, Minister Carlos Rosenkrantz and Judge Beatriz Aranguren spoke out, voting to declare the proposals of the National State inadmissible, due to article 280 of the National Civil and Commercial Procedure Code.

The resolution reinforces a central idea in terms of privacy: delivering data to the State for a procedure does not imply authorizing any subsequent use. If a citizen detects that an organization has personal information, uses it for another purpose or transferred it to another agency, they can resort to the have data to request information about what data is recorded, what it is used for, to whom it was delivered and, if applicable, demand “confidentiality, blocking, rectification or deletion”.

“What the Court basically came to say is that when a person delivers their data to the State for a specific procedure, These data are not from the State: they are still that person’s. They cannot circulate freely between organizations or be used for a different purpose without the owner having previously authorized it,” adds Lucas Barreiro, lawyer specializing in personal data protection.

This also implies that the decision can open the door to other claims when the State uses personal data for something other than what the user had authorized. For example, data provided to a pension organization that is later used for general communications, telephone numbers or emails delivered for an administrative procedure that end in information campaigns, or information given to access a state benefit that passes to another public database without prior notice or specific consent.

Along these lines, Trovato warns that the risk is not only in isolated information, but in what can be constructed from its circulation between bases. “Phone and email seem like minor data, but connected with other data and with what the State knows about a user, They can be a danger. When data circulates, it is not only the data itself: it is what allows us to build,” he concluded.

Thus, the Court did not prohibit all circulation of data within the State, but it did set a limit: any exception to consent must be provided for by law, have a legitimate public interest, be proportional and respect the constitutional right to privacy and data protection.