Promises and practical challenges to data protection compliance for SMEs: a comparative view across LatAm

Sala / Room 822

• Ana Brian, Universidad de Montevideo;
• Pablo Palazzi, Allende & Brea;
• Matias Aranguiz, Pontificia Universidad Catolica de Chile;
• Erica Bakonyi, CTS-FGV.

Moderadores: Nicolo Zingales.

This session will facilitate an evidence-based discussion on the challenges regarding the adequacy of small and/or medium-sized companies to privacy and data protection legislation, as well as their respective impact on judicial proceedings. We aim to generate a comparison of scenarios and maturity levels between Brazil, Argentina, Uruguay and Chile. We would like to suggest a presentation of approximately 10 minutes for each panelist and a total of 30 minutes for debate, with reflections on the following questions:

• Does the national data protection regulation include specific rules in favor of small and medium-sized businesses (SMEs)? If so, can you provide details?
• What is the percentage of data protection adequacy of SMEs? Is there any institutional program or political project specifically targeted to promote adequacy of these actors, or at least to raise their awareness of data protection obligations? If so, is there any monitoring of the effectiveness of these programs or any statistics of evolution in the adherence and adequacy of these actors over the years?
• In relation to the judicialization of data protection cases involving small or medium-sized actors, how has the matter been explored? What are the legal issues that are most frequently litigated (e.g., data leakage, non-response to data rights requests or non-compliance with legal deadlines, fraud, inadequacy of the processes and safeguards adopted, abusive contractual clauses, disputes between controller(s)/processor(s))?
• Have there been successful private actions? If so, what is the average/biggest damages amount that has been awarded?
• Are judges demonstrating a good understanding of data protection legislation? – If you were the legislator, what is the most important amendment of the existing framework that you would make in order to increase data protection compliance and uptake by SMEs?