The State of Communication and Privacy Law in Panama (2020)

  1. Is there a data protection law?
    yes iconyes

    Panama’s data protection law was approved in 2019 and will come into force in March 2021.

    SEE MORE
  2. Is there a data protection authority?
    yes iconyes

    The country’s data protection law, in force as of March 2021, appointed as its oversight body the existing National Authority for Transparency and Access to Information (Autoridad Nacional de Transparencia y Acceso a la Información - ANTAI).

    SEE MORE
  3. Does the data protection law apply to law enforcement activities?
    no iconno

    The data protection law does not apply to the processing of personal data for national security purposes or for the prevention, investigation, detection, or prosecution of criminal offenses or execution of criminal penalties.

    SEE MORE
  4. What are the criteria, if any, for the transfer of personal data to third countries under their data protection law?

    Article 33 of the data protection law sets out the general conditions for a data transfer to be lawful. Additionally, article 5 lays down that the transfer of personal data that are confidential, sensitive, or restricted in any way is allowed when the company responsible for storing or processing such data, and/or the destination country, have standards of protection comparable to those set in the data protection law. It is also allowed if the entity transferring the data takes all the necessary steps to protect them. Still, the law sets some exceptions to these requirements.

    SEE MORE
  5. Panama’s Constitution states that private communications are inviolable and cannot be intercepted or recorded without an order by a judicial authority. Failing to comply with this provision prevents the use of the results as evidence and may also incur criminal responsibilities.

    Interception of communication - Prior judicial order is required.

    Access to the content of communications - Prior judicial order is required; other stored data not considered content of communications can be subject to subsequent judicial review.

    Access to metadata - Prosecutors can directly request it subject to subsequent judicial review.

    Access to subscriber data - Treated like metadata.

    Location data - Similar to metadata; “satellite tracking” requires prior judicial order.

    SEE MORE
  6. What’s the factual basis to access communications data?

    The factual basis for accessing communications data in Panama includes:

    Article 29 of the Political Constitution of the Republic of Panama

    Article 311 of the Criminal Procedure Code

    Articles 11 and 12 of the Law 51/2009

    Articles 15, 24 and 25 of the Law 121/2013

    For details on the above articles,

    SEE MORE
  7. In the context of a criminal investigation, public prosecutors are the competent authorities to request, directly or through a judicial order, the access to communications data.

    SEE MORE
  8. Does the country have provisions about access to data in cases of emergency?

    The Criminal Procedure Code allows the parties to request the judge for anticipated production of evidence in “urgent” cases, described as: (i) a measure considered as a definitive and irreproducible act due to its nature or the circumstances; (ii) statements likely not to be received during the trial due to an obstacle difficult to overcome; (iii) when the accused is a fugitive and the passage of time may hinder evidence preservation; and (iv) when the delay risks losing the evidence source.

    SEE MORE
  9. Is there any data retention mandate?
    yes iconyes

    Law 51/2009 sets out rules for the retention, protection, and handover of telephone and Internet users’ data for criminal investigation purposes. The law stipulates data retention obligations aiming at: (i) tracking and identifying the origin of a communication; (ii) identifying the recipient of a communication; (iii) establishing the time, date, and duration of a communication; (iv) identifying the type of communication; (v) identifying the communication device; (vi) identifying the location of the mobile device and the cell where a communication starts.

    SEE MORE
  10. Are there any rules that authorize the use of malware?

    There are currently no laws that explicitly authorize the use of malware.

  11. Is there any law that compels companies to provide direct access to their internal servers for law enforcement purposes?
    no

    To the best of our knowledge, there is no legal provision authorizing this kind of access in criminal investigations.

  12. Does the law compel companies to assist law enforcement agencies in their investigations?

    The laws regarding the investigation of criminal organizations and the retention of communications data have explicit provisions requiring obliged parties to carry out the investigative measures or to provide the information requested in compliance with conditions set by law. “The obliged parties” usually refers to telecommunication services providers, and requirements can be stricter to concessionaire companies.

    SEE MORE
  13. Does the State report on the number of requests to access communications data?
    no

    To the best of our knowledge, the Panamanian State does not publish reports on the number of requests to access personal data.

  14. Is there any legal limitation that prohibits companies from publishing transparency reports?
    no

    To the best of our knowledge, no normative framework in Panama prohibits companies from publishing statistical data on the number of data requests made by the State. The country’s law on transparency and access to information outlaws the release of restricted information for 10 years counted from its classification as such. This provision, however, cannot halt the release of statistical data, since they do not refer to a specific case, procedure, or document, but to aggregate, undetermined information.

    SEE MORE
  15. Do telecommunication companies publish transparency reports?

    Movistar-Telefónica/Millicom – YES

    Cable & Wireless Panamá/Más Móvil- NO

    Digicel- NO

    Claro- NO

    Movistar-Telefónica publishes annual transparency reports. The local branch was sold to Millicom in 2019. Millicom also publishes transparency reports, but with data aggregated per region, not per country. The company’s 2019 report did not include data on the newly acquired business. Cable & Wireless Panamá/Más Móvil, Digicel, and Claro do not publish transparency reports.

    SEE MORE
  16. Can companies notify users about States’ data requests?

    Companies can notify users beforehand about communications data requests when there is no secrecy obligation in effect. When this obligation exists, user notification can be carried out after the measure is completed or following deadlines set by law.

    SEE MORE