Panama Data Protection Law: Location of Individual who Processes Data

The factor of Location of Individual who Processes Data is used in determining the law's applicability by considering whether the data controller or processor is physically present within Panama's territory, specifically focusing on the domicile of the person responsible for processing personal data.

Text of Relevant Provisions

Executive Order 285/2021 Art.2(2):

"Law 81 of 2019 and this decree will be applicable when: 2. The person responsible for the processing of personal data is domiciled in the Republic of Panama."

Law No. 81 Article 5:

"Article 5. Databases located in the territory of the Republic of Panama, storing or containing personal data of nationals or foreigners, or if the data controller is domiciled in the country, are subject to the rules established in this Law or its regulations."

Analysis of Provisions

The Executive Order 285/2021 and Law No. 81 of 2019 specify that the data protection law applies when the person responsible for processing personal data is domiciled in Panama. This means that the physical presence of the data controller or processor within Panama's territory is a critical factor in determining the law's applicability.

For example, Art.2(2) of Executive Order 285/2021 states that the law applies when the person responsible for processing personal data is domiciled in Panama. Similarly, Art.5 of Law No. 81 specifies that databases located in Panama or data controllers domiciled in Panama are subject to the law.

Implications

The inclusion of this factor has significant implications for businesses in Panama. For example, a company that processes personal data and is domiciled in Panama would be subject to the data protection law, regardless of where the data subjects are located. Conversely, a company that processes personal data but is not domiciled in Panama would not be subject to the law, unless they are targeting the Panamanian market through commercial activities.

For instance, a foreign company that processes personal data of Panamanian citizens but is not domiciled in Panama would not be subject to the law. However, if the same company targets the Panamanian market through commercial activities, they would be subject to the law, as specified in Art.2(4) of Executive Order 285/2021.