HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"EN
23.8.2012 Official
Journal
of
the
European
Union L
227/11
DECISIONS
COMMISSION IMPLEMENTING DECISION
of 21 August 2012
pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate
protection of personal data by the Eastern Republic of Uruguay with regard to automated
processing of personal data
(notified under document C(2012) 5704)
(Text with EEA relevance)
(2012/484/EU)
THE EUROPEAN COMMISSION,
and any decision based on Article 25(6) of Directive
95/46/EC should be made and enforced in a way that
does not arbitrarily or unjustifiably discriminate against
Having regard to the Treaty on the Functioning of the European
or between third countries where like conditions prevail,
Union,
nor constitute a disguised barrier to trade, regard being
had to the European Union’s present international
commitments.
Having regard to Directive 95/46/EC of the European
Parliament and of the Council of 24 October 1995 on the
protection of individuals with regard to the processing of
personal data and on the free movement of such data ( 1 ), and
(5) The
Political
Constitution
of
the
Eastern
Republic
of
in particular Article 25(6) thereof,
Uruguay, passed in 1967, does not expressly recognise
the rights to privacy and the protection of personal data.
However, the catalogue of fundamental rights is not a
After consulting the European Data Protection Supervisor (
closed list since Article 72 of the Constitution provides

2 ),
that the listing of rights, obligations and guarantees made
by the Constitution does not exclude others that are
Whereas:
inherent to the human personality or that derive from
the republican form of government. Article 1 of Act No
18.331 on the Protection of Personal Data and ‘Habeas
Data’ Action of 11 August 2008 (Ley No 18.331 de
(1) Pursuant
to
Directive
95/46/EC,
Member
States
are
required to provide that the transfer of personal data
Protección de Datos Personales y Acción de ‘Habeas
to a third country may take place only if the third
Data’) expressly sets out that ‘the right to the protection
country in question ensures an adequate level of
of personal data is inherent to the human being and it is
protection and if the Member States’ laws implementing
therefore included in Article 72 of the Constitution of
other provisions of the Directive are complied with prior
the Republic’. Article 332 of the Constitution provides
to the transfer.
that the application of the provisions of this Constitution

that acknowledge individuals’ rights as well as those
awarding rights and imposing obligations on public auth
orities, shall not be impaired by of the lack of specific
(2) The
Commission
may
find
that
a
third
country
ensures
regulation; rather, it shall be based, through recourse to
an adequate level of protection. In that case, personal
the underlying principles of similar laws, on the general
data may be transferred from the Member States
principles of the law and generally accepted doctrines.
without additional guarantees being necessary.
(3) Pursuant
to
Directive
95/46/EC
the
level
of
data (6) The
legal
standards
for
the
protection
of
personal
data
in
protection should be assessed in the light of all the
the Eastern Republic of Uruguay are largely based on the
circumstances surrounding a data transfer operation or
standards set out in Directive 95/46/EC and are laid
a set of data transfer operations and giving particular
down in Act No 18.331 on the Protection of Personal
consideration to a number of elements relevant for the
Data and ‘Habeas Data’ Action (Ley No 18.331 de
transfer and listed in Article 25 thereof.
Protección de Datos Personales y de Acción de ‘Habeas
Data’) of 11 August 2008. It covers natural persons and
legal persons.
(4) Given
the
different
approaches
to
data
protection
in
third
countries, the adequacy assessment should be carried out,
( 1 ) OJ L 281, 23.11.1995, p. 31.
(7) This
Act
is
further
complemented
by
Decree
No
414/009
( 2 ) Letter of 31 August 2011.
of 31 August 2009, adopted in order to clarify several

---

L 227/12
EN
Official Journal of the European Union
23.8.2012
aspects of the Act and to lay down the detailed regu
the supervision by the data protection authority. With
lation of the organisation, powers and functioning of the
regard to the transparency principle, the Uruguayan
data protection supervisory authority; The Preamble of
data protection authorities have informed that the
the Decree sets out that it is appropriate to adjust the
obligation to provide the data subject with the
national legal system on this matter to the most accepted
necessary information applies in all cases. Regarding
comparable legal regime, essentially that established by
the right of access, the data protection authority has
European countries through Directive 95/46/EC.
clarified that it is sufficient for a data subject to prove
its identity when making a request. The Uruguayan data
protection authorities have clarified that the exceptions
relating to the principle on international transfers laid
(8) Data
protection
provisions
are
also
contained
in
a
down in Article 23(1) of Act No 18.331 cannot be
number of special acts that create and regulate databases,
understood as having a broader application than that
namely, acts regulating certain public registries (public
of Article 26(1) of Directive 95/46/EC.
deeds, industrial property and trade marks, personal
acts, real estate, mining or credit reporting). Act No
18.331 applies additionally to these acts in relation to
those issues that are not governed by these specific legal
instruments, pursuant to Article 332 of the Constitution.
(12) This
Decision
takes
into
account
these
explanations
and
assurances and it is based upon them.
(9) The
legal
data
protection
standards
applicable
in
the
Eastern Republic of Uruguay cover all the basic principles
(13) The Eastern Republic of Uruguay is also party to the
necessary for an adequate level of protection for natural
American Convention of Human Rights (‘Pact of San
persons, and also provide for exceptions and limitations
José de Costa Rica) of 22 November 1969, and in
in order to safeguard important public interests. These
force since 18 July 1978
( 1 ). Article 11 of this
legal data protection standards and the exceptions reflect
Convention lays down the right to privacy and Article 30
the principles laid down by Directive 95/46/EC.
sets out that restrictions that, pursuant to this
Convention, may be placed on the enjoyment or
exercise of the rights or freedoms recognised by the
Convention may not be applied except in accordance
(10) The
application
of
the
legal
data
protection
standards
is
with laws enacted for reasons of general interest and in
guaranteed by administrative and judicial remedies, in
accordance with the purpose for which such restrictions
particular, by the ‘habeas data’ action, which enables a
have been established (Article 30). Moreover the Eastern
data subject to take a data controller to court in order to
Republic of Uruguay has accepted the jurisdiction of the
enforce his right of access, rectification and deletion, and
Inter-American Court of Human Rights. Furthermore at
by independent supervision carried out by the super
the 1118th meeting of the Ministers’ Deputies of the
visory authority, the Unit for the Regulation and
Council of Europe held on 6 July 2011, the Deputies
Control of Personal Data (Unidad Reguladora y de
invited the Eastern Republic of Uruguay to accede the
Control de Datos Personales (URCDP)), which is
Convention for the Protection of Individuals with regard
invested with powers of investigation, intervention and
to Automatic Processing of Personal Data (ETS No 108)
sanction in line with Article 28 of Directive 95/46/EC,
and to its Additional Protocol (ETS No 118), after a
and which acts completely independently. Moreover, any
favourable opinion of the relevant Consultative Commit
interested party is entitled to seek judicial redress for
tee ( 2 ).
compensation for damages suffered as a result of the
unlawful processing of his personal data.
(14) The
Eastern
Republic
of
Uruguay
should
therefore
be
(11) Uruguayan
data protection authorities have provided
regarded as providing an adequate level of protection
explanations and assurances as to how the Uruguayan
for personal data as referred to in Directive 95/46/EC.
law is to be interpreted, and have given assurances that
the Uruguayan data protection legislation is implemented
in accordance with such interpretation. In particular,
Uruguayan data protection authorities have explained
that, pursuant to Article 332 of the Constitution, Act
(15) This
Decision
should
concern
the
adequacy
of
protection
No 18.331 applies additionally to special acts that
provided in the Eastern Republic of Uruguay with a view
create and regulate specific databases in relation to
to meeting the requirements of Article 25(1) of Directive
those issues that are not governed by these specific
95/46/EC. It should not affect other conditions or
legal instruments. They have also clarified that,
regarding the lists referred to in Article 9 C) of Act No
( 1 ) Organisation of American States; OAS, Treaty Series, No 36, 1144
18.331, and which do not require the consent of the
UNTS 123. http://www.oas.org/juridico/english/treaties/b-32.html
data subject for the processing, the Act also applies,
( 2 ) Council of Europe: https://wcd.coe.int/wcd/ViewDoc.jsp?Ref=CM/Del/
Dec(2011)1118/10.3&Language=lanEnglish&Ver=original&Site=
namely the principles of proportionality and finality,
CM&BackColorInternet=DBDCF2&BackColorIntranet=FDC864&
the rights of data subjects and that they are subject to
BackColorLogged=FDC864

---

EN
23.8.2012 Official
Journal
of
the
European
Union L
227/13
restrictions implementing other provisions of that
(a) where a competent Uruguayan authority has determined
Directive that pertain to the processing of personal
that the recipient is in breach of the applicable standards
data within the Member States.
of protection; or
(16) In
the
interest
of
transparency
and
in
order
to
safeguard
the ability of the competent authorities in the Member
(b) where there is a substantial likelihood that the standards of
States to ensure the protection of individuals as regards
protection are being infringed, there are reasonable grounds
the processing of their personal data, it is necessary to
for believing that the competent Uruguayan authority is not
specify the exceptional circumstances in which the
taking or will not take adequate and timely steps to settle
suspension of specific data flows may be justified,
the case at issue, the continuing transfer would create an
notwithstanding the finding of adequate protection.
imminent risk of grave harm to data subjects and the

competent authorities in the Member State have made
reasonable efforts in the circumstances to provide the
party responsible for processing established in the Eastern
(17) The
Commission
should
monitor
the
functioning
of
the
Republic of Uruguay with notice and an opportunity to
Decision and report any pertinent findings to the
respond.
Committee established under Article 31 of Directive
95/46/EC. Such monitoring should cover, inter alia, the
Eastern Republic of Uruguay’s regime applicable to
transfers in the framework of international treaties.
2. The suspension shall cease as soon as the standards of
protection are assured and the competent authority of the
Member States concerned is notified thereof.
(18) The
Working
Party
on
the
protection
of
individuals
with
regard to the processing of personal data established
under Article 29 of Directive 95/46/EC has delivered a
favourable opinion on the level of adequacy as regards
Article 3
protection of personal data which has been taken into
1. Member
States
shall
inform
the
Commission
without
account in the preparation of this Decision ( 1 ).
delay when measures are adopted on the basis of Article 2.
(19) The
measures provided for in this Decision are in
accordance with the opinion of the Committee estab
2. The
Member
States
and
the
Commission
shall
inform
each
lished under Article 31(1) of Directive 95/46/EC,
other of cases where the action of bodies responsible for
ensuring compliance with the standards of protection in the
Eastern Republic of Uruguay fails to secure such compliance.
HAS ADOPTED THIS DECISION:
3. Where
the
information
collected
under
Article
2
and
Article 1
under paragraphs 1 and 2 of this Article provides evidence
that any body responsible for ensuring compliance with the
1. For the purposes of Article 25(2) of Directive 95/46/EC,
standards of protection in the Eastern Republic of Uruguay is
the Eastern Republic of Uruguay is considered as ensuring an
not effectively fulfilling its role, the Commission shall inform
adequate level of protection for personal data transferred from
the competent Uruguayan authority and, if necessary, present
the European Union.
draft measures in accordance with the procedure referred to in
Article 31(2) of Directive 95/46/EC with a view to repealing or
suspending this Decision or limiting its scope.
2. The
competent
supervisory
authority
of
the
Eastern
Republic of Uruguay for the application of the legal data
protection standards in the Eastern Republic of Uruguay is set
out in the Annex to this Decision.
Article 4
The Commission shall monitor the functioning of this Decision
and report any pertinent findings to the Committee established
Article 2
under Article 31 of Directive 95/46/EC, including any evidence
1. Without prejudice to their powers to take action to ensure
that could affect the finding in Article 1 of this Decision, that
compliance with national provisions adopted pursuant to
protection in the Eastern Republic of Uruguay is adequate
provisions other than Article 25 of Directive 95/46/EC, the
within the meaning of Article 25 of Directive 95/46/EC and
competent authorities in Member States may exercise their
any evidence that this Decision is being implemented in a
existing powers to suspend data flows to a recipient in the
discriminatory way.
Eastern Republic of Uruguay in order to protect individuals
with regard to the processing of their personal data in the
following cases:
Article 5
Member States shall take all the measures necessary to comply
( 1 ) Opinion 6/2010 on the level of protection of personal data in the
Eastern Republic of Uruguay. Available at http://ec.europa.eu/justice/
with the Decision within three months of the date of its notifi
policies/privacy/docs/wpdocs/2010/wp177_en.pdf
cation.

---

L 227/14
EN
Official Journal of the European Union
23.8.2012
Article 6
This Decision is addressed to the Member States.
Done at Brussels, 21 August 2012.
For the Commission
Viviane REDING
Vice-President
ANNEX
Competent supervisory authority referred to in Article 1(2) of this Decision:
Unidad Reguladora y de Control de Datos Personales (URCDP)
Andes 1365, Piso 8
Tel. + 598 2901 2929 Int. 1352
11.100 Montevideo
URUGUAY
Contact e-mail: http://www.datospersonales.gub.uy/sitio/contactenos.aspx
Online complaints: http://www.datospersonales.gub.uy/sitio/denuncia.aspx
Website: http://www.datospersonales.gub.uy/sitio/index.aspx

---

Document Outline

• �

---