Uruguay


Definition Sensitive Data: Under Uruguayan Regulation, “Sensitive Data” is considered “Specially Protected”. “Sensitive data” include personal data revealing racial or ethnic origin, political preferences, religious or moral beliefs, trade union membership, and information relating to health or sex life. The law provides a more restrictive regime for the treatment of this kind of data, establishing an obligation to obtain the data subject’s express written consent for such treatment. Yes, the Data Protection Law sets forth special protections for sensitive data. No one may be compelled to provide sensitive data; and sensitive data may only be collected or processed with the prior express written consent of the data subject. However, sensitive data can be collected and processed for reasons of general interest allowed by law, or where the applicant has legal mandate to do so. Sensitive data may be processed for statistical or scientific purposes when they are disassociated from the data subjects.
The creation of databases that store sensitive data is prohibited. There are exceptions for databases of political parties, trade unions, churches, religious groups, associations, foundations, and other non-profit organizations with political, religious, philosophical, or association purpose, which may contain information about racial or ethnic origin, health or sex life of their members.
Personal data relating to the commission of criminal, civil or administrative act can only be processed by the public authorities, within the framework of laws and regulations, subject to the approvals required by law or regulations.
In addition, the Data Protection Law contains special protections for health data. It allows public and private health institutions and professionals operating in areas related to health sciences to collect and process personal data pertaining to the physical or mental health of patients who are or have been under treatment, as long as they abide by the principles of professional secrecy and comply with the requirements of the Data Protection Law.