Peru's Law No. 29733 on the Protection of Personal Data ('the Law') incorporates a national security and law enforcement exemption, limiting its applicability to certain public sector data processing activities.

Text of Relevant Provisions

The Law Art.3(2):

"This Act applies to personal data contained or intended to be contained in public administration and private administration personal data banks, the processing of which is carried out in the national territory. Sensitive data are subject to special protection. The provisions of this Act do not apply to the following personal data: [...] 2. To those contained or intended to be contained in public administration data banks, only to the extent that their processing is necessary for the strict fulfilment of the competences assigned by law to the respective public entities, for national defence, public security, and for the development of activities in criminal matters for the investigation and repression of crime. () Article amended by the Third Amending Complementary Provision of Legislative Decree No. 1353, published on 7 January 2017."*

Analysis of Provisions

The Law establishes a broad exemption for certain public sector data processing activities related to national security and law enforcement. This exemption is outlined in Article 3(2), which states that the Law does not apply to personal data "contained or intended to be contained in public administration data banks" under specific circumstances.

The exemption is not absolute but is limited to data processing that is "necessary for the strict fulfilment of the competences assigned by law to the respective public entities". This wording suggests that the exemption is not a blanket exclusion for all public sector data processing, but rather a targeted exemption for specific activities.

The provision explicitly mentions four areas where this exemption applies:

1. National defense
2. Public security
3. Development of activities in criminal matters
4. Investigation and repression of crime

It's important to note that the exemption only applies "to the extent" that the processing is necessary for these purposes. This language implies that public entities must still justify the necessity of their data processing activities and cannot rely on a broad interpretation of this exemption.

The rationale behind this exemption is likely rooted in the recognition that certain state functions, particularly those related to national security and law enforcement, may require greater flexibility in data processing. Lawmakers often include such exemptions to balance individual privacy rights with the state's need to maintain public safety and national security.

Implications

The implications of this exemption are significant for both public entities and private organizations:

1. Public sector entities: Law enforcement agencies, national security organizations, and other relevant public bodies have more latitude in their data processing activities when operating within the specified areas. However, they must ensure that their activities strictly align with their legally assigned competences.
2. Private sector organizations: While the exemption primarily affects public entities, private companies working with or on behalf of these entities in the specified areas may also be indirectly affected. For instance, a private company providing data processing services to a law enforcement agency might need to consider how this exemption applies to their activities.
3. Data subjects: Individuals whose data is processed for national defense, public security, or law enforcement purposes may have limited recourse under this data protection law. However, it's important to note that other legal safeguards may still apply.
4. Scope of application: The exemption's language suggests a narrow interpretation. Public entities must be prepared to demonstrate that their data processing activities are indeed necessary for the specified purposes and fall within their legally assigned competences.
5. Oversight and accountability: While exempt from certain provisions of the data protection law, public entities processing data under this exemption may still be subject to other forms of oversight or accountability measures to prevent potential misuse of this exemption.