Uruguay's Data Privacy Law Deemed "Adequate" by EU

The European Union recently approved Uruguay's data privacy law as providing "adequate" protection. Under the EU Data Privacy Directive, personal data cannot be transferred out of an EU member state to a non-EU member state unless the third country's laws are adequate, or other exceptions apply. These exceptions include if individual consent has been obtained, a model contract has been executed between the exporter and the importer, or if the importer (in the third country) has binding corporate rules in place. Only a handful of countries have had their laws deemed adequate, and Uruguay follows Argentina as the second in Latin America. The decision was anticipated, since in 2010 the Article 29 Working Party indicated that it believed Uruguay's law should receive the adequacy designation.

TIP: Companies who are hoping to move personal information from the EU to Latin America will now find two jurisdictions – Uruguay and Argentina - where such a transfer will be easier. Other countries whose laws have been deemed adequate include Canada, Israel, and Switzerland.