The Automated Means Criterion in Panama's data protection law is primarily addressed in Executive Order 285/2021, which supplements Law No. 81 on Personal Data Protection 2019. Article 2(4) of the Executive Order explicitly extends the law's applicability to data processing that occurs "in the context of a commercial activity - by Internet or any other means of electronic or digital communication."

This provision specifically targets data processing activities that utilize automated means, particularly those involving internet-based or other electronic communication channels. The inclusion of this criterion reflects the law's recognition of the prevalence of digital data processing in modern commercial activities.

It's important to note that the provision links this criterion to "activities aimed at the Panamanian market." This connection suggests that the law's scope is not solely determined by the use of automated means but also by the intended target of the commercial activity.

The reference to Law 51 of 2008 in the provision indicates that the interpretation and application of this criterion should be in line with existing regulations on electronic and digital communications in Panama.

Implications

The inclusion of the Automated Means Criterion in Panama's data protection law has several implications for businesses:

1. Broad coverage: The law applies to a wide range of digital and electronic data processing activities, potentially encompassing most modern business operations that involve personal data.
2. Market targeting: Companies engaging in e-commerce or digital marketing activities directed at the Panamanian market are likely to fall under the law's jurisdiction, even if they are not physically present in Panama.
3. Technological neutrality: The provision's wording ("Internet or any other means of electronic or digital communication") ensures that the law remains applicable as technology evolves, covering both current and future forms of automated data processing.
4. Cross-border applicability: International businesses targeting the Panamanian market through digital means may need to comply with Panama's data protection law, regardless of their physical location.
5. Commercial focus: The provision specifically mentions "commercial activity," which may exclude certain non-commercial automated data processing activities from the law's scope.