You are here

Uruguay

Country:
Survey Answer:

As a general rule, the processing of personal data is permitted if the data subject has given free, prior, explicit and informed consent, which must be documented. There are exceptions to the aforementioned principle. The exceptions include:
1. When the data comes from public sources of information, such as registries or publications in mass media;
2. When the data are collected for the performance of functions of the government or under a legal obligation;
3. For listings that are limited to names, identity document, nationality, address, and date of birth regarding individuals. In the case of legal entities, the corresponding data are corporate name, brand name, tax identification number, address, phone number, and identity of the people in charge;
4. When the data derives from a contractual, scientific or professional relationship of the data subject, and are necessary for its development or execution; and
5. When the treatment is carried out by an individual for his/her own personal and domestic use.
When the processing is based on the consent of the data subject, the data subject must be informed in such a way that the subject is unequivocally aware of the purpose for which the data will be used and the type of activity undertaken by the data controller. Otherwise, the consent may be considered null and void.
In addition, the use of personal data is forbidden for purposes that are different from or inconsistent with those that led to their collection. The data must be removed when it no longer is necessary or relevant to the purposes for which they were collected.
Also, the law prohibits the sharing or combination of personal data from different databases without the prior informed consent of the data subject, unless there is a special provision in a law.
The law allows exceptions to the limitation on retention such as when the data have value for historical, statistical, or scientific basis.

Provided By:
Martin Pesce, Ferrere Abogados