close sidebar
    Data Protection Overview
  1. Is there a data protection law?
  2. Is there a data protection authority?
  3. Does the data protection law apply to law enforcement activities?
  4. What are the criteria, if any, for the transfer of personal data to third countries under their data protection law?
    5. Communications Privacy Law
  5. What’s the legal authorization needed to access communications data?
  6. What’s the factual basis to access communications data?
  7. Which authorities have the legal capacity to request access to communications data?
  8. Does the country have provisions about access to data in cases of emergency?
  9. Is there any data retention mandate?
  10. Are there any rules that authorize the use of malware?
  11. Is there any law that compels companies to provide direct access to their internal servers for law enforcement purposes?
  12. Does the law compel companies to assist law enforcement agencies in their investigations?
    13. The State of Communication and Privacy Law in Panama (2020)
    Transparency & Communications Privacy
  13. Does the State report on the number of requests to access communications data?
  14. Is there any legal limitation that prohibits companies from publishing transparency reports?
  15. Do telecommunication companies publish transparency reports?
  16. Can companies notify users about States’ data requests?
Back to top

The State of Communication and Privacy Law in Panama (2020)

By Katitza Rodríguez Veridiana Alimonti
in collaboration with Abdías Zambrano (IPANDETEC) Luiza Rehder

This report focuses on criminal investigations and builds on the 2016 Panama comprehensive study.

  1. Is there a data protection law?
    yes iconyes

    Panama’s data protection law was approved in 2019 and will come into force in March 2021.

    See more
    2. Back to top
  2. Is there a data protection authority?
    yes iconyes

    The country’s data protection law, in force as of March 2021, appointed as its oversight body the existing National Authority for Transparency and Access to Information (Autoridad Nacional de Transparencia y Acceso a la Información - ANTAI).

    See more
    3. Back to top
  3. Does the data protection law apply to law enforcement activities?
    no iconno

    The data protection law does not apply to the processing of personal data for national security purposes or for the prevention, investigation, detection, or prosecution of criminal offenses or execution of criminal penalties.

    See more
    4. Back to top
  4. What are the criteria, if any, for the transfer of personal data to third countries under their data protection law?

    Article 33 of the data protection law sets out the general conditions for a data transfer to be lawful. Additionally, article 5 lays down that the transfer of personal data that are confidential, sensitive, or restricted in any way is allowed when the company responsible for storing or processing such data, and/or the destination country, have standards of protection comparable to those set in the data protection law. It is also allowed if the entity transferring the data takes all the necessary steps to protect them. Still, the law sets some exceptions to these requirements.

    See more
    5. Back to top

  5. Panama’s Constitution states that private communications are inviolable and cannot be intercepted or recorded without an order by a judicial authority. Failing to comply with this provision prevents the use of the results as evidence and may also incur criminal responsibilities.

    Interception of communication - Prior judicial order is required.

    Access to the content of communications - Prior judicial order is required; other stored data not considered content of communications can be subject to subsequent judicial review.

    Access to metadata - Prosecutors can directly request it subject to subsequent judicial review.

    Access to subscriber data - Treated like metadata.

    Location data - Similar to metadata; “satellite tracking” requires prior judicial order.

    See more
    Back to top
  6. What’s the factual basis to access communications data?

    The factual basis for accessing communications data in Panama includes:

    Article 29 of the Political Constitution of the Republic of Panama

    Article 311 of the Criminal Procedure Code

    Articles 11 and 12 of the Law 51/2009

    Articles 15, 24 and 25 of the Law 121/2013

    For details on the above articles,

    See more
    Back to top

  7. In the context of a criminal investigation, public prosecutors are the competent authorities to request, directly or through a judicial order, the access to communications data.

    See more
    Back to top
  8. Does the country have provisions about access to data in cases of emergency?

    The Criminal Procedure Code allows the parties to request the judge for anticipated production of evidence in “urgent” cases, described as: (i) a measure considered as a definitive and irreproducible act due to its nature or the circumstances; (ii) statements likely not to be received during the trial due to an obstacle difficult to overcome; (iii) when the accused is a fugitive and the passage of time may hinder evidence preservation; and (iv) when the delay risks losing the evidence source.

    See more
    Back to top
  9. Is there any data retention mandate?
    yes iconyes

    Law 51/2009 sets out rules for the retention, protection, and handover of telephone and Internet users’ data for criminal investigation purposes. The law stipulates data retention obligations aiming at: (i) tracking and identifying the origin of a communication; (ii) identifying the recipient of a communication; (iii) establishing the time, date, and duration of a communication; (iv) identifying the type of communication; (v) identifying the communication device; (vi) identifying the location of the mobile device and the cell where a communication starts.

    See more
    Back to top
  10. Are there any rules that authorize the use of malware?

    There are currently no laws that explicitly authorize the use of malware.

    Back to top
  11. Is there any law that compels companies to provide direct access to their internal servers for law enforcement purposes?
    no

    To the best of our knowledge, there is no legal provision authorizing this kind of access in criminal investigations.

    Back to top
  12. Does the law compel companies to assist law enforcement agencies in their investigations?

    The laws regarding the investigation of criminal organizations and the retention of communications data have explicit provisions requiring obliged parties to carry out the investigative measures or to provide the information requested in compliance with conditions set by law. “The obliged parties” usually refers to telecommunication services providers, and requirements can be stricter to concessionaire companies.

    See more
    Back to top
  13. Does the State report on the number of requests to access communications data?
    no

    To the best of our knowledge, the Panamanian State does not publish reports on the number of requests to access personal data.

    14. Back to top
  14. Is there any legal limitation that prohibits companies from publishing transparency reports?
    no

    To the best of our knowledge, no normative framework in Panama prohibits companies from publishing statistical data on the number of data requests made by the State. The country’s law on transparency and access to information outlaws the release of restricted information for 10 years counted from its classification as such. This provision, however, cannot halt the release of statistical data, since they do not refer to a specific case, procedure, or document, but to aggregate, undetermined information.

    See more
    15. Back to top
  15. Do telecommunication companies publish transparency reports?

    Movistar-Telefónica/Millicom – YES

    Cable & Wireless Panamá/Más Móvil- NO

    Digicel- NO

    Claro- NO

    Movistar-Telefónica publishes annual transparency reports. The local branch was sold to Millicom in 2019. Millicom also publishes transparency reports, but with data aggregated per region, not per country. The company’s 2019 report did not include data on the newly acquired business. Cable & Wireless Panamá/Más Móvil, Digicel, and Claro do not publish transparency reports.

    See more
    16. Back to top
  16. Can companies notify users about States’ data requests?

    Companies can notify users beforehand about communications data requests when there is no secrecy obligation in effect. When this obligation exists, user notification can be carried out after the measure is completed or following deadlines set by law.

    See more
    17. Back to top