Use of Equipment Within Jurisdiction for Data Protection Law Applicability in Uruguay

The use of equipment within Uruguay is a factor in determining the applicability of Uruguayan data protection law to data processing activities.

Text of Relevant Provisions

Decree No. 414/009 Art.3(1B):

"Personal data processing is subject to the Law that is regulated when: B) The database controller or processor is not established in Uruguayan territory but uses means located in the country for data processing."

Original (Spanish):

"El tratamiento de datos personales está sometido a la Ley que se reglamenta cuando: B) El responsable o encargado del tratamiento no está establecido en territorio uruguayo, pero utiliza medios situados en el país para el tratamiento de los datos."

Decree No. 414/009 Art.3(2):

"The aforementioned rule does not apply to cases where the aforementioned means are exclusively used for transit purposes, as long as the database controller or processor designates a representative, with a domicile and permanent residence in national territory, before the Control Authority, in order to comply with the obligations established by the Law that is regulated and in this regulation. Such designation shall not prevent legal actions that may be brought against the database controller or processor, nor shall it diminish their responsibility regarding compliance with the obligations imposed by law or regulations."

Original (Spanish):

"La mencionada regla no se aplicará cuando los citados medios se utilicen únicamente con fines de tránsito, siempre que el responsable o encargado de la base de datos o tratamiento designe un representante, con domicilio y residencia permanente en territorio nacional, ante el Órgano de Control, a fin de cumplir con las obligaciones previstas por la Ley que se reglamenta y en este decreto. Tal designación se realizará sin perjuicio de las acciones que pudieran emprenderse contra el propio responsable o encargado de la base de datos o tratamiento, ni disminuirá su responsabilidad en cuanto al cumplimiento de las obligaciones impuestas por la ley o el reglamento."

Analysis of Provisions

The Uruguayan data protection law extends its applicability to data controllers and processors not established in Uruguay if they use "means located in the country for data processing." This provision effectively expands the territorial scope of the law beyond entities physically present in Uruguay to those that utilize equipment or resources within the country's borders for data processing activities.

However, the law provides an important exception to this rule. If the "means are exclusively used for transit purposes," the law does not apply, provided that the data controller or processor designates a representative in Uruguay. This representative must have a domicile and permanent residence in the country and be registered with the Control Authority.

The term "means" (medios) is not explicitly defined in the provided text, but it likely encompasses a wide range of equipment and resources used for data processing, such as servers, data centers, or other technological infrastructure located in Uruguay.

It's important to note that even if a representative is designated, this does not prevent legal actions against the controller or processor, nor does it diminish their responsibility to comply with the law's obligations.

Implications

This provision has several implications for businesses:

1. Non-Uruguayan companies using any data processing equipment or resources in Uruguay may be subject to Uruguayan data protection law, even if they have no physical establishment in the country.
2. Companies that only use equipment in Uruguay for data transit (e.g., data merely passing through servers located in Uruguay) can avoid the law's application by appointing a local representative.
3. The appointment of a representative does not shield companies from legal liability or reduce their obligations under Uruguayan law.
4. International businesses must carefully assess their data processing activities and the location of their equipment to determine whether they fall under Uruguayan jurisdiction.
5. Companies may need to implement measures to track and document the use of any data processing equipment in Uruguay to ensure compliance with local laws.