Panama's Law No. 81 on Personal Data Protection 2019 incorporates exemptions for national security and law enforcement activities, limiting the law's applicability in these areas.

Text of Relevant Provisions

Law No. 81 Art.3(3):

"Excluded from the scope of this Law are those treatments expressly regulated by special laws or by the regulations that develop them, in addition to the following personal data treatments: [...] 3. Those carried out for the analysis of financial intelligence and related to national security in accordance with the laws, treaties or international agreements that regulate these matters."

Law No. 81 Art.3(2):

"Excluded from the scope of this Law are those treatments expressly regulated by special laws or by the regulations that develop them, in addition to the following personal data treatments: [...] 2. Those carried out by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties."

Analysis of Provisions

Law No. 81 explicitly excludes certain types of data processing from its scope, including those related to national security and law enforcement activities. This exemption is common in data protection laws worldwide, recognizing the need for government agencies to operate effectively in matters of public safety and national security.

The law provides two specific exemptions:

1. National Security and Financial Intelligence: Article 3(3) excludes data processing "carried out for the analysis of financial intelligence and related to national security". This exemption covers activities crucial for maintaining national security and combating financial crimes. The provision specifies that such activities must be conducted "in accordance with the laws, treaties or international agreements that regulate these matters", ensuring that these exemptions are not applied arbitrarily but within established legal frameworks.
2. Law Enforcement: Article 3(2) exempts data processing "carried out by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties". This broad exemption covers various aspects of law enforcement activities, from crime prevention to the execution of criminal sentences.

These exemptions are designed to allow relevant authorities to perform their duties without the potential restrictions that data protection regulations might impose on their operations. However, it's important to note that the law specifies these exemptions are for treatments "expressly regulated by special laws or by the regulations that develop them", indicating that these activities are not entirely unregulated but are governed by specific legal frameworks.

Implications

The national security and law enforcement exemptions in Panama's data protection law have several implications:

1. Government agencies involved in national security, financial intelligence, and law enforcement can process personal data without being bound by the general data protection rules set out in Law No. 81.
2. Companies and organizations that work with or provide data to these government agencies for national security or law enforcement purposes may also be exempt from certain data protection obligations when processing data for these specific purposes.
3. Individuals whose data is processed for national security or law enforcement purposes may have limited rights under the data protection law in relation to that specific data processing.
4. Organizations handling personal data must be aware of these exemptions to ensure they apply the correct legal framework when processing data that may fall under these categories.
5. The exemptions do not provide a blanket exclusion for all government activities. Only those specifically related to national security, financial intelligence, and law enforcement as defined in the law are exempt.
6. While exempt from Law No. 81, these activities are still subject to their own regulatory frameworks, which may include specific data protection measures tailored to the sensitive nature of national security and law enforcement operations.