Ecuador's Personal Data Protection Law ('the Law') establishes a comprehensive framework for data protection, encompassing both material and territorial applicability factors.

Material Applicability Factors

The Law's material scope is primarily defined by the Automated Means Criterion, which ensures broad coverage of data processing activities.

Automated Means Criterion

The Law Article 3:

"This Organic Law shall apply to the processing of personal data contained in any type of medium, whether totally automated, partially automated or non-automated, and to all forms of subsequent use, by controllers or processors of personal data belonging to the public or private sectors at the national level"

This provision establishes a comprehensive approach to data processing methods. The Law applies regardless of the level of automation, covering fully automated systems, partially automated processes, and even manual data handling. This technological neutrality ensures the law remains relevant as data processing techniques evolve.

The phrase "any type of medium" further broadens the scope, encompassing various data storage formats, from digital databases to paper records. By including "all forms of subsequent use," the Law extends protection throughout the data lifecycle, from collection to deletion.

The Law applies equally to both public and private sectors, creating a uniform data protection standard across all organizational types in Ecuador.

Territorial Applicability Factors

The Law's territorial scope is determined by several factors, ensuring comprehensive coverage of data processing activities related to Ecuador.

Processing by Local Establishment

The Law Article 4(b):

"Without prejudice to the regulations established in the international conventions and treaties ratified by the Ecuadorian State that deal with this matter, this Organic Law shall apply when: (b) The controller or processor of personal data is domiciled in any part of the national territory;"

This provision extends the Law's applicability to any entity with a domicile in Ecuador, regardless of where the actual data processing occurs. The term "domiciled" likely refers to an entity's permanent establishment or principal place of business within Ecuador.

Processing by Entity Registered or Incorporated in Jurisdiction

The same provision (Article 4(b)) also covers entities legally registered or incorporated in Ecuador. This ensures that all companies with a formal legal presence in the country are subject to the Law's requirements, even if their data processing activities occur elsewhere.

Use of Equipment Within Jurisdiction

The Law Article 4(e):

"Without prejudice to the regulations established in the international conventions and treaties ratified by the Ecuadorian State that deal with this matter, this Organic Law shall apply when: [...] e) The controller or processor of personal data is not domiciled in the national territory and uses or has recourse to automated, partially automated or non-automated means located in Ecuador to process personal data, unless such means are used only for transit purposes."

This provision extends the Law's reach to non-domiciled entities that use equipment located in Ecuador for data processing. It covers a wide range of processing methods, from fully automated to manual, but excludes cases where the equipment is used solely for data transit.

Offering Goods and Services to Data Subjects in Jurisdiction

The Law Article 4(c):

"Without prejudice to the regulations established in the international conventions and treaties ratified by the Ecuadorian State that deal with this matter, this Organic Law shall apply when: (c) The controller or processor of personal data not domiciled in the national territory who offers Ecuadorians goods or services, regardless of whether or not payment is required, or carries out activities relating to the control of their behaviour;"

This factor captures foreign entities engaging with the Ecuadorian market, even without a physical presence in the country. It applies to both paid and free offerings, as well as to entities monitoring the behavior of Ecuadorians.

Conclusion

Ecuador's Personal Data Protection Law establishes a broad scope of applicability, both materially and territorially. It covers all forms of data processing, regardless of automation level, and extends to entities domiciled in Ecuador, using equipment in the country, or offering goods and services to Ecuadorians.