Personal data protection in Ecuador, a few steps forward

A few months away from its first year in force, the Ecuadorian law on personal data protection has a pending task in the construction of the national system for the protection of personal data: the designation of the authority.

In Ecuador, since 2008, we have had five state functions: executive, legislative, judicial, electoral and the function of transparency and social control. The data protection authority will be located in the function of transparency and social control, which brings together all the control bodies of the State, and will take the form of a Superintendency, as provided for in the regulation above. The appointment process starts with the creation of a shortlist of three candidates by the Presidency of the Republic. The law establishes that the Superintendent must meet certain requirements, and for obvious reasons candidates for the post must comply with these requirements:

1. He or she must be a professional in law, information systems, communications, or technology.
   
   
2. Must have a fourth level degree.
   
   
3.  Must have at least 10 years' experience in areas related to the protection of personal data.

On 2 March, the Council for Citizen Participation and Social Oversight, a body which, in accordance with Article 208.10 of the Constitution of the Republic of Ecuador, has the power to appoint the first authority of the superintendencies, issued the Regulations for the Appointment of the Head of the Data Protection Authority, by the shortlist proposed by the Executive, in which it adds one more requirement to be eligible for appointment as head of the DPA, indicating that it is derived from the Organic Law of Public Service, such as being an Ecuadorian citizen.

In addition, the law also sets out the prohibitions for being a member of the shortlist, in an exhaustive manner:

1. Be under judicial interdiction for as long as it subsists, except in the case of insolvency or bankruptcy that has not been declared fraudulent.
   
   
2. They have received an enforceable sentence of imprisonment for as long as this sentence remains in force.
   
   
3. Maintain contracts with the State, as a natural person, partner, representative or attorney-in-fact of legal persons, for the acquisition of goods, execution of public works, provision of public services or exploitation of natural resources.
   
   
4. Have not complied with the rehabilitation measures decided by the competent authority, in the event of having been sanctioned for domestic or gender violence.
   
   
5. Have exercised executive authority in de facto governments.
   
   
6. Have been sentenced for crimes against humanity and hate crimes.
   
   
7. Have outstanding obligations with the Internal Revenue Service or the Ecuadorian Institute of Social Security, without a settlement or compensation formula and which are not pending judicial resolution.
   
   
8. Exercise a popularly elected dignity.
   
   
9. Are members of the Armed Forces and the National Police on active duty or representatives of religious cults.
   
   
10. Owe alimony, duly certified by the competent judicial authority.
    
    
11. Are spouses, have a common-law relationship, or are related up to the fourth degree of consanguinity or second degree of affinity to members of the Technical Selection Committee of the Council for Citizen Participation and Social Control or to the President or Vice-President.
    
    
12. They have been found to be administratively, civilly or criminally liable for the exercise of their public functions.
    
    
13. Have an enforceable sentence, issued by the Electoral Disputes Tribunal, for any offence defined in the Organic Law on Elections and Political Organisations of the Republic of Ecuador-Democracy Code, punishable by the suspension of political and participation rights for as long as the sentence remains in force;
    
    
14. Incur in other prohibitions determined by the Constitution and the law.

It is important to know that these Regulations give the Executive 30 days to submit the list of three candidates and begin the appointment process.

Likewise, under the current Regulation of Oversight Bodies for the Selection Processes of Members of Citizen Commissions and for the Appointment of Authorities, which derives from the provisions of the Constitution, in articles 66 numeral 25, 95 and 227, and which is later included in article 63 of the Organic Law of Citizen Participation and Social Control, the process for the formation of the oversight body for the appointment of the Superintendent of the APD was opened, which closed its nominations on the 24th of this month.

This marks the first steps towards this important appointment, but the work of building the national system for the protection of personal data has only just begun. The new Superintendent will be responsible for the construction of the Data Protection Authority, with all the issues that this entails, such as budget, structure and even the location of its headquarters.

Article provided by INPLP member: Christian Espinosa-Velarde (ECIJA GPA, Ecuador)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)