Law No. 81 Article 3(2) establishes an exemption from the scope of the data protection law for certain types of data processing activities. Specifically, it excludes "those carried out by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties" from the law's applicability.

This provision is broader than a typical judicial proceedings exemption, as it encompasses not only court activities but also law enforcement and criminal justice processes. The exemption covers various stages of the criminal justice system, including:

1. Prevention of criminal offenses
2. Investigation of crimes
3. Detection of criminal activities
4. Prosecution of offenders
5. Execution of criminal penalties

The rationale behind this exemption is likely to ensure that law enforcement and criminal justice authorities can effectively carry out their duties without being unduly constrained by data protection requirements. This allows for a balance between individual privacy rights and the public interest in maintaining law and order.

It's important to note that this exemption is limited to "competent authorities" engaged in these specific activities. While the law does not provide a definition of "competent authorities," it can be reasonably interpreted to include courts, law enforcement agencies, prosecutors, and other official bodies involved in the criminal justice system.

Implications

The implications of this exemption for businesses and individuals in Panama are significant:

1. Law enforcement agencies and criminal justice authorities have greater flexibility in processing personal data for crime prevention, investigation, and prosecution purposes.
2. Individuals may have limited data protection rights when their personal information is processed in the context of criminal proceedings or law enforcement activities.
3. Companies that provide services or technologies to law enforcement or criminal justice authorities may need to consider this exemption when handling personal data on behalf of these entities.
4. Private entities that are not "competent authorities" cannot rely on this exemption and must comply with the data protection law even if they are processing data related to criminal activities (e.g., private security firms or corporate investigation units).
5. The exemption does not appear to cover civil court proceedings or administrative tribunals, which may still be subject to the general data protection requirements unless covered by other specific exemptions or regulations.