Panama: AI regulation & deadlines

Ley 81 art. 19 — a Directive 95/46 automated-decision right that fires only on NEGATIVE legal effects, with three exits and no safeguards at all

Binds Responsables del tratamiento de los datos and custodios de la base de datos — controllers and the parties holding custody of the database on the controller's behalf — public or private, for profit or not. Art. 5 fixes the reach: databases located in the territory of the Republic of Panama that store personal data of nationals or foreigners, and databases whose controller is domiciled in the country, are subject to the Law and its regulation. There is no GDPR art. 3(2) targeting limb: a purely foreign controller with no Panamanian database and no Panamanian domicile is outside the Law even when it decides about people in Panama. Databases of subjects governed by leyes especiales are excluded, but only where those special laws or their implementing rules set the minimum technical standards needed for correct protection of personal data conforming to this Law; and art. 36 makes this Law's sanctions apply supletoriamente where a sector regulator's own statute does not expressly define the penalty for the breach complained of.. Art. 19 of Ley 81 de 26 de marzo de 2019, «Sobre Protección de Datos Personales» (Gaceta Oficial Digital Nº 28743-A of 29 March 2019), gives the data subject «derecho a no ser sujeto de una decisión basada únicamente en el tratamiento automatizado de sus datos personales, que produzca efectos jurídicos negativos o le produzca un detrimento a un derecho, cuyo objeto sea evaluar determinados aspectos de su personalidad, estado de salud, rendimiento laboral, crédito, fiabilidad, conducta, características o personalidad, entre otros». The shape is Directive 95/46 art. 15(1) rather than GDPR art. 22: the trigger is cumulative and its third limb is an OBJECT requirement — the decision must be one whose purpose is to evaluate personal aspects — and the illustrative list (work performance, creditworthiness, reliability, conduct) is the Directive's list carried across almost word for word. Two things are done to the effects threshold that no other rule in the atlas does together. First, «efectos jurídicos» is qualified as «NEGATIVOS»: a legal effect that helps the subject does not engage the right at all, where GDPR art. 22 and the whole Directive family are indifferent to whether the effect is adverse. Second, the alternative limb is not «significantly affects» but «le produzca un detrimento a un derecho» — detriment to a right — which trades an open-ended severity test for a narrower requirement that some right be impaired. The exits are three: consent of the subject; necessity to conclude or perform a contract or legal relationship between the controller and the subject; and authorisation by special laws or the norms developing them. Panama therefore adds a consent exit to the Directive's two — and then attaches NOTHING to any of them. There is no right to obtain human intervention, no right to express a point of view, no right to contest the decision, and no bar on running such decisions on sensitive data. Art. 19 is one sentence of prohibition followed by three ways out, and it is the barest automated-decision provision in the atlas: even Montenegro's pre-GDPR art. 15a folded the chance to express a view into its contract exit. The word «perfil» never appears in Ley 81. Profiling enters Panamanian law only through the reglamento, Decreto Ejecutivo Nº 285 de 28 de mayo de 2021 (Gaceta Oficial Digital Nº 29296-A of the same date), whose art. 2(7) defines «elaboración de perfiles» in the GDPR art. 4(4) terms and whose transparency articles then speak of «la existencia de decisiones automatizadas, incluida la elaboración de perfiles, a que se refiere el artículo 19 de la Ley 81 de 2019» — attributing to art. 19 a concept the article does not contain. The same reglamento supplies the disclosure limb the statute omits: on collection and on a subject access request the controller must give «información significativa sobre la lógica aplicada, así como la importancia y las consecuencias previstas de dicho tratamiento», which is GDPR art. 13(2)(f)/15(1)(h) language grafted on by executive decree rather than enacted by the legislature. Art. 21 of the Law voids any act or agreement between parties that limits the subject's rights — but it lists «acceso, revocación, cancelación, oposición o bloqueo» and does not name art. 19, so the anti-waiver clause does not on its face reach the automated-decision right, which the consent exit already lets a controller contract around.

In force since 29 March 2021. Art. 47 is the whole vigencia clause — «Esta Ley comenzará a regir a los dos años de su promulgación» — and it names no date, so the date has to be computed. The Law is dated 26 March 2019 and was published in Gaceta Oficial Digital Nº 28743-A of 29 March 2019, which on the Panamanian understanding of promulgación (publication in the Gaceta Oficial) puts entry into force two years later, on 29 March 2021. That reading is confirmed by the Executive itself in a primary source: the considerandos of the reglamento, Decreto Ejecutivo Nº 285 de 28 de mayo de 2021, record that Ley 81 «estableció, además, una prórroga para su entrada en vigor, efectiva a partir del 29 de marzo de 2021». Taking the date of the Law instead of the date of the gazette would give 26 March 2021; the Executive's own published reading is preferred over that computation and no conflict between two primary sources arises. The reglamento entered into force on its own promulgation (its art. 65), i.e. 28 May 2021. The Law was Proyecto 665 de 2018, approved in third debate on 24 October 2018. No amendment to Ley 81 has been located on the gazette record.

Stated maximum penalty — B/.1,000 to B/.10,000 — the whole range, with no turnover alternative and no separate corporate ceiling. Art. 38 grades infractions as leves, graves or muy graves; art. 40(2) makes it a GRAVE infraction to «infringir los principios y garantías establecidos en la presente Ley o en su reglamentación», and that catch-all is the route by which a breach of art. 19 is fineable, since neither art. 40 nor art. 41 names art. 19 and the ARCO-specific item at art. 40(4) reaches only access, rectification, cancellation and objection. Art. 43 attaches the consequences: a falta leve draws only a citación before the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI), a falta grave draws «multas según su proporcionalidad», and a falta muy grave draws closure of the database registers or temporary or permanent suspension and disqualification of the processing activity, in each case without prejudice to the corresponding fine. The only figures in the statute are in art. 36, which directs ANTAI to fix the amounts by gravity «desde mil balboas (B/.1 000.00) hasta diez mil balboas (B/.10 000.00)». The balboa is at par with the US dollar, so the maximum exposure for the gravest breach of Panamanian data-protection law is about USD 10,000 — the lowest absolute ceiling of any rule in the atlas, and the reglamento does not raise it: Decreto Ejecutivo Nº 285 art. 62 supplies only graduation criteria (intent, recidivism, harm, duration, benefit obtained, turnover affected) within that band. Limitation runs at one year for leves, three for graves and five for muy graves (art. 63 of the reglamento). Art. 37 preserves a separate civil action before the courts for patrimonial and moral damage.