Habeas Data vs the
European Data Protection Directive
 

Revised version of paper published in:
  JILT 2000 (2):
 

Andrés Guadamuz, LLM
PhD Student,
Queen's University of Belfast
A.guadamuz@qub.ac.uk
 

Abstract

This paper is mostly an update on an article that first appeared in this journal in June 2000 [1 ] regarding the relatively recent legal figure of Habeas Data, which has been implemented in some countries in Latin America. The need to update the original article arose from the fact that there have been many new developments regarding the implementation of this legal tool in Latin America, and because of some other interesting developments in the European Union that required that some of the original conclusions be revisited and amended. This paper was first presented in the 16th Annual Conference of the British and Irish Legal Education and Technology Association (BILETA) in April 2001[2], my thanks to the attendants for their input, which helped in revising the present work. The paper has many sections that are similar to the original, with the intention of making the update a stand-alone document. A shorter two-part version of the paper appeared in the World Data Protection Report[3].

This is a revised Refereed article published on 7 November 2001.

Citation: Guadamuz A, 'Habeas Data vs the European Data Protection Directive', Refereed article, 2001 (3) The Journal of Information, Law and Technology (JILT). <http://elj.warwick.ac.uk/jilt/01-3/guadamuz.html>.New citation as at 1/1/04: <http://www2.warwick.ac.uk/fac/soc/law/elj/jilt/2001_3/guadamuz/>.

1. Introduction

The European Union has been enacting serious Data Protection legislation by the means of a Data Protection Directive[4] that poses a burden on member states to put in place laws that comply with its provisions. Among those provisions there is a prohibition to the member states to transfer data to countries with no adequate Data Protection legislation in place. This provision in particular has proven to be incredibly contentious because of the nature of the modern global economy and the importance of data transfer and electronic commerce to the major trading countries. This has sparked an international debate that has engulfed the United States and the European Union in colossal struggle to resolve the issue[5]. It is not the role of the present essay to delve into the detail of such struggle, but many important questions have risen from this debate.

This is where the new Latin American Habeas Data right becomes important. Does it comply with the standards of adequacy established by the European Union? What is Habeas Data anyway? Is it effective? This paper will attempt to answer these questions.

1.1 History of Habeas Data

The individual complaints before a Constitutional Court have a long tradition in the history of the Law. The first complaint that existed, and perhaps the most famous, is the Habeas Corpus (which is roughly translated as 'you should have the body'). It originated on the Middle Ages in England and it is a writ issued by a court commanding that a person held in custody is brought before a court so that it may determine whether the detention is legal. Some other individual complaints exist, such as the writ of mandamus (USA), amparo (Spain and Mexico), Respondeat superior (Taiwan), etc[6]. The newest of these legal mechanisms is the Habeas Data.

The Habeas Data writ itself has a very short history, but its origins can be traced to certain European legal mechanisms that protected individual privacy. This cannot come as a surprise, as Europe is the birthplace of the modern Data Protection.

In particular, certain German constitutional rights can be identified as the direct progenitors of the Habeas Data right. In particular, the German Constitutional Tribunal created the right to information self-determination by interpretation of the existing rights of human dignity and personality[7]. This is a right to know what type of data is stored on manual and automatic databases about an individual, and it implies that there must be transparency on the gathering and processing of such data[8].

It has been pointed out that by the 1960's the right to controls the information about oneself was being extensively discussed in quite a lot of specialised legal literature, where the need of the citizens to control the information stored about them was not only an act of self defence against abuses by others, but it had become an active right against the technological handling of personal data, which created a new type of problem for the individual[9].

The direct predecessor of the Habeas Data right is the Council of Europe's 108^th Convention on Data Protection of 1981[10]. The purpose of the convention is to secure the privacy of the individual regarding the automated processing of personal data. To achieve this, several rights are given to the individual, including a right to access their personal data held in an automated database[11].

However, we must ask ourselves how did the first European privacy protection efforts cross the Atlantic and landed in Latin America under a new guise.

The end of the 1980s and the beginning of the 1990s can only be described as a very interesting period in the history of Latin America. The end of the Cold War brought a resurgence of stability and democracy to the region. The old military regimes gave way to young and vibrant democracies. These new regimes had to start from scratch in most cases, and that is why so many new Constitutions were created in this period.

That is the case of the Federal Republic of Brazil. In 1988, the Brazilian legislature voted a new Constitution, which included a novel right never seen before: the Habeas Data individual complaint. It is expressed as a full constitutional right under article 5, LXXI, Title II, of the Constitution. It is clear from the details of the new constitutional right that the framers of the Brazilian Constitution were aware of the developments and huge advancements in data protection taking place in Europe. It is unclear however why it was decided to create it in the form it took, which does not resemble any of the existing European solutions to the Data Protection problem. The fact is that the new legal right offered a new type of privacy defence, unlike both the North American and the European types of Data Protection. In 1997, the Brazilian Parliament enacted the Law No. 9507, which is the Regulatory Law of the Habeas Data Proceeding[12]. It was voted to regulate certain aspects of the law offered in the Constitution, as it lacked the proper procedural and administrative guidelines.

Following the Brazilian example, Paraguay incorporated the Habeas Data right to its new Constitution in 1992. After that, many countries followed suit and adopted the new legal tool in their respective constitutions: Peru in 1993, Argentina in 1994, Ecuador in 1996, and Colombia in 1997.

Habeas Data is gaining momentum and moving northwards. There are projects to incorporate the new right in Guatemala, Uruguay, Venezuela and Costa Rica[13], and several important writers and political groups support the implementation of the figure both in Panama[14] and in Mexico[15].

1.2 What is Habeas Data?

The literal translation from Latin of Habeas Data is 'you should have the data' and it describes its nature very accurately. Habeas Data is a constitutional right granted in several countries in Latin America. It shows variations from country to country, but in general, it is designed to protect, by means of an individual complaint presented to a constitutional court, the image, privacy, honour, information self-determination and freedom of information of a person.

Habeas Data has been described as:

The importance that this figure has is stressed by the fact that it can be a mechanism available to citizens that will insure a real control over sensible personal data, stopping the abuse of such information, which will be detrimental to the individual[17].

In general, the Habeas Data complaint can be brought up by any citizen against any register to find out what information is held about his or her person. That person can request the rectification, update or even the destruction of the personal data held, it does not matter most of the times if the register is private or public. Ekmekdjian points out that all Habeas Data legislations should provide the individual with at least the following rights:

• Provide access to the registers to control the personal or family data.
   

• Provide means to update or correct obsolete data.
   

• Insure the confidentiality of important personal information.

Provide means to remove or cancel sensible data, which may injure the individual's right to privacy, such as religion, political ideology, sexual orientation or any other potentially discriminatory information[18].

The legal nature of the individual complaint of Habeas Data is that of voluntary jurisdiction, this means that the person whose privacy is being compromised can be the only one to present it. The Courts do not have any power to initiate the process by themselves[19].

Most of the local laws concerning Habeas Data do not differentiate whether the mechanism should be used against manual or automated databases. It will then have to be assumed that it covers both. The efficiency of the tool as an adequate privacy protection action for the individual will be discussed in detail later.

1.3 Habeas Data From Country to Country

Because Habeas Data is a new figure, it is obvious that it is in constant evolution as it responds to different local situations. The particularities from some of the countries where it has been used will be discussed next.

1.3.1 Brazil

Being the birthplace of the Habeas Data action, the Brazilian legislation is the less evolved one, and it is also the one that provides one of the poorest privacy protection tools. The 1988 Brazilian Constitution stipulates that:

It is interesting to notice that the Constitution only allows for the access to and the correction of data, not for its update or destruction. The 1997 regulatory law to the Habeas Data procedure provides the individual with the right to add an annotation to the data stored on a registry where it is stated that such data is under legal dispute[21]. This provides a novel way to inform third parties that certain personal data is under contention.

The tribunal where the Habeas Data action is presented changes depending on who is it presented against, thus creating a very complicated system of venues. Both the Brazilian constitution and the 1997 law stipulate that the court will be:

• The Superior Federal Tribunal for actions against the President, both chambers of Congress and itself;
   

• The Superior Justice Tribunal for actions against Ministers or itself;
   

• The regional federal judges for actions against federal authorities;
   

• State tribunals according to each state law;
   

• State judges for all other cases[22 ].

Besides this system, there are several mentions about Habeas Data in the existing military legislation in Brazil[23], mostly regarding jurisdiction issues and further confusing the already complicated system.

1.3.2 Paraguay

The 1992 Paraguay constitution follows the example set by Brazil, but enhances the protection in several ways. The Article 135 of the Paraguayan constitution states:

Besides giving the individual the opportunity to find out what the information is being used for and for what purpose, the Paraguayan system allows for the updating, rectification or destruction of the data. In just four years, and in another country, the Habeas Data constitutional guarantee has evolved and gained strength. This is a much better definition than the Brazilian one, and shows that the Paraguayan congressional representatives not only copied its neighbour's version, but actually did some research on the subject.

The Habeas Data version of Paraguay is also better than the Brazilian one in its procedural aspects. The constitutional chamber of the Supreme Court is the one in charge of hearing and deciding cases of Habeas Data, centralising the application of the constitutional guarantee in an existing tribunal[25].

1.3.3 Peru

As the previous two countries, the Habeas Data right was introduced to Peru by means of a new constitution that was enacted after a large political upheaval.

The Article 200, section 3 of the new constitution, creates the Habeas Data. In a sense, the Peruvian constitution allows for less privacy protection than that of its predecessors, but in some other ways provides more. It provides less protection because it does not allow for the rectification or removal of incorrect data stored on a database, such as the Paraguayan version. Nevertheless, it provides more protection because it forbids the broadcast, copying, transfer or distribution of the incorrect data. Nevertheless, the Peruvian version of the Habeas Data right allows only for one case of rectification of inaccurate or aggravating information. The press is the only institution in all of Peru compelled to rectify such type of data according to the constitution[26].

The Peruvian Habeas Data version is also the first one that specifically mentions that the citizens have the right not to have any personal data supplied by any 'information service, automated or not'[27]. It is clear now that the Habeas Data covers both manual and automated systems.

The Peruvian Legislature enacted a regulatory law on April 18, 1995. Among several procedural provisions, the Congress decided not to apply the Habeas Data right to the press. This measure came because of various complains by human rights activists that saw this as a way to interfere with the freedom of expression rights, protected also by the constitution[28].

It can be argued that the Peruvian version of Habeas Data seems less effective and more politicised than its predecessors. It is unclear how this figure will be affected by the change of government and the end to the polemical rule of Alberto Fujimori. It does appear that the legislation was created to insure control over the press, but that function should no longer be important in a more open political environment.

1.3.4 Argentina

The Argentinean version of Habeas Data is not specifically called that. For an unknown reason, the Argentinean legislators have merged several individual constitutional complaints under the name of amparo, which can be roughly translated as 'shelter'. The amparo is a constitutional guarantee that exists in many other countries in Latin America and the civil system in Europe such as Spain and Portugal[29]. Whatever it is called, the Argentinean version of Habeas Data is the most complete to this date. The article 43 of the Constitution, amended on the 1994 reform, states that:

This version includes most of the protection seen in previous constitutions, such as the right to access the data, rectify it, update it or destroy it, such as the Paraguayan one. Nevertheless, the Argentinean constitution also includes a couple of excellent features. The first is that it incorporates the Peruvian idea of confidentiality of data, being interpreted as the prohibition to broadcast or transmit incorrect or false information. The second is that it specifically excludes the press from the action, which is only sensitive in a country that is remaking its democratic institutions after years of ruthless military dictatorship.

A regulatory law of the Habeas Data action approved by the Argentinean congress in 1996 was vetoed by the Executive Branch because it was vague and provided controversial provisions about the exchange of data between different public institutions[31]. However, Argentinean legislators have recently muddied the application of the Habeas Data by the approval of a European style Data Protection legislation[32]. The problems that this new law presents to the existing Habeas Data will be discussed in the next section.

1.3.5 Colombia

Colombia passed a new Constitution in 1991, which included provisions that defended the right to privacy. This was reformed in 1997 to include the new figure of habeas data specifically. The text now recognises the right to individual privacy, and states that citizens have:

The Colombian Constitutional Court declared a legislation specifying the regulation of this right unconstitutional in 1992[34]. After that, there have been several rulings by the Colombian Constitutional Court recognising habeas data as part of the Colombian Constitution and admitting the information self-determination right as a fundamental part of the constitutional system[35]. This fact is important because it shows that habeas data is being used and recognised in the Colombian courts.

1.3.6 Costa Rica

Although the constitutional action of Habeas Data has not yet been approved by the Costa Rican congress, the existing project promises to be the most comprehensive so far. The law will modify the Article 48 of the constitution to add the Habeas Data action, but it will also amend the law No. 7128, the Law of Constitutional Jurisdiction. This law is the one that regulates the individual complaints to the constitutional court. The existing actions are Habeas Corpus, amparo and the unconstitutionality action.

The new law seeks to protect the privacy of the individual in a similar way to the Argentinean constitution. It provides that the action, once accepted by the constitutional court, will allow for the access, rectification, update, inclusion, destruction or confidentiality of the personal data in dispute. This adds one more tool to the Habeas Data action: the right to include data into a registry[36].

Besides these tools, the Costa Rican version also includes several principles, probably translated literally from the European Union's data protection Directive. One just needs to glimpse at some of them to confirm that suspicion: personal data will be treated adequately and will not be excessive in relation to the purpose or purposes for which they are processed; the individual has the right to receive information about the treatment given to his data, and others[37].

One of the principles is quite novel though. The individual has to authorise specifically that his personal data will receive an automated treatment. It is unclear if this is a good idea; this principle may be used to bog down businesses. It sounds unlikely that any type of operation will be able to ask for this type of permission on every transaction.

As for the procedural provisions, the project states clearly that the action can only be presented to the constitutional court, thus being subjected to the procedure of set out in the Constitutional legislation[38]. It will be processed before other actions with exception of the Habeas Corpus.

Unfortunately, the law that will implement habeas data as another constitutional defence in Costa Rica has not yet been enacted and is still under revision by the Costa Rican Parliament. There is strong opposition to the Habeas Data Law from some sectors of the press[39]. This is caused by the fact that it does not have provisions that protect freedom of speech rights, such as those of Peru and Argentina. It is feared that corrupt characters will misuse the guarantee to avoid investigations into their affairs by the press.

2. Adequacy of Habeas Data as a Data Protection Tool

2.1 Is Habeas Data Effective?

After describing the evolution of the Habeas Data right, the next task is to analyse its effectiveness as an adequate Data Protection tool.

Whether Habeas Data will be successful will depend on many different factors, but the main one will be the effectiveness of each judicial system. It is rather difficult to measure each country's judicial institutions lacking actual caseload statistics and other hard data. It is clear that the legislation ahs already been creating case law in Brazil, Argentina, Paraguay and Colombia[40]. Nevertheless, it can be stated as a fact that Latin American courts are often understaffed and overworked, common characteristics of the legal systems of developing countries.

An encouraging sign though is that the Habeas Data guarantee is receiving full constitutional strength in most of the countries in which it is being enacted. In civil systems of law, this is the highest level of protection possible, and faster procedures and better courts usually accompany it[41].

It may be encouraging that Habeas Data has been incorporated into the constitutions of a lot of countries in Latin America, but the efforts to regulate the figure and make it ready for everyday use have been slow. Brazil has finally passed a regulating law, but as it has been pointed out, it offers a very complicated set of rules for venues. Argentina has not passed a regulating law yet, but that has not stopped the flow of Habeas Data actions being presented[42]. In other countries, like Paraguay and Peru, the regulating laws are in place but only some time after the right had been approved. Costa Rica will avoid that problem by enacting simultaneously the constitutional reform and the regulating law. It will obtain the highest constitutional protection and a specialised Constitutional Court will cover it.

Another encouraging sign that points towards the Habeas Data principle becoming an adequate and popular tool is an unforeseen effect when the law was passed. The action is being hailed as an excellent Human Rights tool, mostly in the countries that are recovering from military dictatorships. In Paraguay for example, it was used to view the records from an old police station, bringing to light several atrocities that were committed at that site[43].

In a landmark case in Argentina, an important ruling from the Supreme Court stated that the Habeas Data right applied implicitly also to the families of the deceased. This opened the door to families of the 'disappeared', the victims of the military regime, to request access to police and military files, otherwise closed to them[44].

These examples show an encouraging sign. If the general public regards the legal mechanism favourably because of its use as a Human Rights tool regards the legal mechanism favourably, it is possible that its use will increase and spread to other areas of life, such as the protection of personal data in electronic databases.

Regarding automated databases and online information, which are the real subjects of this essay, the Habeas Data right may crash against two big problems. The first is a problem that can be found world wide, and is also common to all areas of Information Technology Law: the legal profession is usually slow to understand computers[45]. If this is true for the developed countries, it can be expected to be more so in developing countries. It is foreseeable that many courts in Latin America will find problems when faced with complicated descriptions of mainframes, databases, data processing and information storage devices.

The other problem faced by Habeas Data, as an effective online privacy protection tool, is the very nature of the global Information Superhighway. An excellent example would be a multinational company that gathers information in a country and then sends it through a corporate network to another country. How can that be stopped? In addition, how do you present a Habeas Data action against a company that is not based in your country?

The Habeas Data guarantee gives the individual the right to access, rectify, update, include, destroy or maintain the confidentiality of sensitive personal information, but it is obvious that it will be difficult to achieve that if the data is stored abroad. Nevertheless, everything suggests that it will be an adequate tool for protecting privacy locally.

2.2 Does Habeas Data Comply With European Standards?

After analysing the application of Habeas Data in some Latin American countries, it is important to point out that perhaps the greatest test to Habeas Data will come from abroad, in particular from Europe. As it was mentioned in the Introduction, the European Directive on Data Protection requires its members to impose strict restrictions against the transfer of data to countries that do not posses data protection regulation[46].

For example, The United Kingdom's Data Protection Act of 1998 states that:

This principle leaves a large area for interpretation for government agencies and for the courts. What is exactly an 'adequate level of protection'?

At first there was no consensus on what level of protection would be considered adequate, the Commission informed that:

The Commission later issued a report that established the minimum set of principles that a country should have to be able to be considered as providing adequate protection. These are:

• Purpose limitation principle: data should be gathered for a specific purpose only;
   

• Data quality and proportionality principle: Data should be accurate and kept up to date;
   

• Transparency principle: individuals should be provided with information as to the purpose of the processing and the identity of the data controller;
   

• Security principle: the data should be secure from unwanted access by others;
   

• Rights of access, rectification and opposition: the individual should have a right to obtain a copy of all data relating to him/her, and a right to rectification of those data where they are shown to be inaccurate;
   

• Restrictions on onward transfers: Data should only be transferred onward of the second recipient complies with the minimum data protection requirements[49 ].

The Working Party also recommended that each case should be considered individually, as:

The discussions with the United States regarding this issue helped immensely to setup an understanding of what adequacy means. In particular, several documents by the Commission's Working Party on Data Protection offer a better insight into the issue[51], and ratified the fact that these minimum requirements are necessary before granting permission for data transfer[52].

It would seem that Latin American Habeas Data fulfils at least requirements of transparency, rectification, update, accuracy and purpose, but that not all versions of Habeas Data provide security provisions, and none place restrictions on transfer to other countries. Only the Costa Rican project is close to fulfilling most of the requirements, something more is certainly required if Habeas Data is going to be considered up to European standards. It then can be stated that the Latin American countries that have incorporated the Habeas Data guarantee to their constitutions cannot be considered as countries that provide an adequate level of protection of personal privacy.

What then can these countries do? Perhaps as a result of the lengthy discussions between the EU and the United States, and maybe fearing that this provision will have an adverse effect on electronic commerce, the Commission's Working Party has opened the possibility to accept transfer of personal information to countries with no protection by means of a contract by which the data handler will agree to comply with the basic principles required by the EU Directive[53]. This proposal is on consultation at the time of writing this paper[54].

2.3. Habeas Data vs. European Style Legislations in Latin America

If Habeas Data fails to live up to European standards as it exists today, it may not come as a surprise that some countries in Latin America are choosing to implement a more restrictive version of data protection that resembles the levels established on the other side of the Atlantic.

It is very interesting to notice that Chile, one of the most legally advanced countries in South America, bypassed entirely the Habeas Data route and enacted a data protection law that regulates data handling and storage in a very European way[55]. Chile has a very strong private industry sector, which may account for a different approach to data protection than its neighbours[56].

Brazil and Argentina have also decided to follow the European lead. A Data Protection legislation based on the Portuguese law is under discussion in the Brazilian Federal Parliament[57]. Being based on the existing legislation of a EU member, it is fair to assume that it will provide more protection than the existing Habeas Data Constitutional provisions and that it will include some of the principles required for obtaining adequacy level from the EU.

Argentina has recently passed new European style data protection legislation[58] to complement and enhance its existing constitutional provisions. This new legislation is very comprehensive and provides more than the minimum requirements of adequacy established by the European Commission. Among many others, the new law:

• Requires data handlers to be registered;
   

• Establishes that data should be gathered for the purpose it was created, and should not be excessive, or that it cannot be used for other means;
   

• Provides the right to individuals to access, update, rectify or delete inaccurate or outdated information;
   

• Commands data handlers to insure the security of the data;
   

• Prohibits the transfer of data to countries that do not posses data protection regulation[59].

It is important to point out that the approval of this legislation does not affect the existing Habeas Data provision described in the Argentinean constitution, but actually complements it. It can be said that this trend to enact tougher regulation of information may not be a threat to Habeas Data, but it is certainly making its future an uncertain one.

3. Conclusion

Habeas Data is a legal tool for data protection that has been undoubtedly evolving to provide better protection to personal information from one country to the other. Undoubtedly, Habeas Data in its better expressions can be a very important tool to insure the information self-determination of the individual. Besides this, Habeas Data has proven that its constant evolution and rapid spread throughout the region can be attributed to its simplicity. That same simplicity makes it the best option for other countries interested in enacting privacy protection legislation, as it can be adopted at a minimum cost. There is no need to create more government agencies as the action can be implemented within existing judicial structures. The other advantage of Habeas Data is that it provides the highest level of constitutional protection to the average citizen.

Nevertheless, some of the existing forms of Habeas Data fail to provide adequate levels of protection according to the minimum European standards, which may be a problem for countries that want to join in the electronic commerce revolution, as information is the currency of the Digital Age.

It is imperative that the nations that want to provide adequate protection of personal privacy and the transfer of information must make sure that they comply with the minimum levels of protection established by the European Directive on Data Protection, failing to do so will only be detrimental to the basic individual rights.

Despite this problem, Habeas Data is still the most viable solution for the implementation of safeguard of information in developing countries, providing an effort is made to properly institute it. In that respect the example of Argentina has to be noticed and followed, stronger protections seems the proper way to go.

Footnotes

1. Guadamuz Andres. 'Habeas Data: The Latin-American Response to Data Protection', 2000 (2) The Journal of Information, Law and Technology (JILT), < http://www2.warwick.ac.uk/fac/soc/law/elj/jilt/2000_2/guadamuz/>.

2. See: <http://www.law.ed.ac.uk/script/BILETA2001.htm>.

3. 'Habeas Data: An Update on the Latin America Data Protection Constitutional Right - Part 1', World Data Protection Repo rt, Volume I, Issue 4, April 2001, BNA International, London. And 'Habeas Data: An Update on the Latin America Data Protection Constitutional Rght - Part 2', World Data Protection Report. Volume I, Issue 5, May 2001, BNA International, London.

4. European Council. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (1996), < http://europa.eu.int/eur-lex/en/lif/dat/1995/en_395L0046.html>.

5. For a detailed account of this issue, see: Charlesworth, Andrew, (2000), 'Clash of the Data Titans: US and EU Data Privacy Regulation', 6 European Public Law. Pp.253 - 274.

6. Mavcic, Andre, Individual Complaint Proceedings Before Constitutional Courts.

7. Chirino, Alfredo (1997) 'Las Tecnologías de la Información y el Proceso Penal, Análisis de una Crisis Anunciada', Revista de Ciencias Penales (December 1997) No.14 < http://www.nexos.co.cr/cesdepu/revelec/penal/Chirino14.htm>.

8. Chirino, Alfredo (1997). Op. Cit.

9. Chirino, Alfredo (1997), Autodeterminacion Informativa y Estado de Derecho en la Sociedad Tecnologica (1997), San Jose, Costa Rica, Edit CONAMAJ. P.14.

10. Prescott, Charles A (1998), Recent Developments in Latin America and Asia Are Driven by Local Interests and Technology', Privacy & American Business (1998), <http://hudson.idt.net/~pab/global.html>.

11. European Council (1981), Council of Europe Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data (1981), < http://europa.eu.int/comm/internal_market/en/media/dataprot/inter/con10881.htm>.

12. Congresso Nacional do Brasil (1997), Lei 9507 Regula o Direito de Acesso a Informações e Disciplina o Rito Processual do Habeas Data. November 12 1997, < http://infojur.ccj.ufsc.br/arquivos/Direito_Administrativo/9507-97.htm>.

13. Palazzi, Pablo (2000), 'Protección de Datos Personales, Privacidad y Habeas Data en América Latina', Ulpiano.com (May 2000), < http://www.ulpiano.com/Recursos_Privacy_LatinAmerica.htm>.

14. Hoyos, Arturo (1997), '¿Adónde van nuestras democracias?', El Panamá Améríca (January 29 1997), < http://www.epasa.com/El_Panama_America/archive/012997/opinion1.html>

15. Aveleyra, Antonio (1996), Propuesta Legislativa de Nuevos Tipos Penales en Relación con la Informática, < http://www.inegi.gob.mx/pdi/nv/asesoria/foro/temas6/propinf.htm>

16. Falcón, Enrique (1996), Hábeas Data: Concepto y Procedimiento (1996) Editorial Abeledo Perrot, Buenos Aires p.28.

17. González Murúa, Ana Rosa (1994), El Derecho a la Intimidad, el Derecho a la Autodeterminación Informativa, Instituto de Ciencias Sociales, Barcelona. p.23.

18. Ekmekdjian, Miguel Ángel (1996), El Derecho a la Intimidad Frente a la Revolución Informática, Editorial Depalma, Buenos Aires, p.96.

19. Mavcic, Andre. Op. Cit. 1^st Paragraph.

20. Constitution of the Federal Republic of Brazil (1988), Article 5, Section LXXI, < http://www.georgetown.edu/LatAmerPolitical/Constitutions/Brazil/brtitle2.html>.

21. Congresso Nacional do Brasil. Lei 9507. Op. Cit. Article 7, sub-section III.

22. Brazilian Constitution, Title IV, Chapter III, Sections II-VI. 1997 Regulatory law, Art. 20.

23. Palazzi, Pablo. 'Protección de Datos Personales, Privacidad y Habeas Data en América Latina', Op. Cit.

24. ICL, Paraguay Constitution (June 20th 1992), Translated by Peter Heller. Article 135,
<http://www.uni-wuerzburg.de/law/pa00t___.html>.

25. Paraguay Constitution. Ibid. Articles 131, 136 and.259.

26. Torres, Carlos (1994), 'El Habeas Data en el Extranjero', El Peruano (June 30th 1994), <http://www.asesor.com.pe/teleley/p3511.htm>.

27 . Base de Datos Políticos de las Américas, Constitución Política del Perú, 1993 (July 1st 1993), Article 2, section 6. Translated by the author of this essay, < http://www.georgetown.edu/pdba/Constitutions/Peru/peru.html>.

28. IFEX. Habeas Data Law Modified and Approved (April 1995), <http://holland.ifex.org/alert/00000712.html>.

29. Mavcic. Ibid.

30. ICL. Constitution of the Argentine Nation (1853),Translation by the Argentine congress, Article 43, <http://www.uni-wuerzburg.de/law/ar00000_.html>.

31. Clarín Digital (1996), 'Habeas Data: El Poder Ejecutivo Vetó una Ley Cuestionada por los Bancos', El Clarín Digital (December 31 1996), < http://www.clarin.com.ar/diario/96-12-31/o-01401d.htm>.

32. Congreso de Argentina. Ley de Protección de Datos (September 14, 2000), <http://www.ulpiano.com/habeadata_diputados.htm>.

33. Constitución Política de Colombia (1997), Art.15, < http://www.georgetown.edu/LatAmerPolitical/Constitutions/Colombia/colombia.html>.

34 . Palazzi, P. Op. Cit.

35.Corte Constitucional (Colombian Constitutional Court), rulings SU-157/99, SU 166/99, SU 167/99 and Sentencia No. SU-089/95. It is of particular importance the plenary session of the Constitutional Court of March 1st 1995, ruling Sentencia No. SU-082/95, < http://www.ulpiano.com/Recursos_Privacidad_colombiaSu082-95.htm>.

36. Mendez, William (1998), 'Recurso de Hábeas Data: Ley Limita Divulgar Datos Privados', La Nación (July 30th, 1998), < http://www.nacion.co.cr/ln_ee/1998/julio/30/pais4.html>.

37. Herrera, Berlioth (1998), Freno a Hábeas Data, La Nación (August 5th, 1998), < http://www.nacion.co.cr/ln_ee/1998/agosto/25/pais4.html>.

38. Asamblea Legslativa de Costa Rica. Ley de la Jurisdicción Constitucional (Ley No. 7135, del 19 de octubre de 1989).

39. La Nación (1998),(Editorial) 'Un proyecto descaminado', La Nación (August 1st, 1998), < http://www.nacion.co.cr/ln_ee/1998/agosto/01/opinion1.html>.

40. Palazzi, Op. Cit.

41. Saborío, Rodolfo (1996), 'El Bloque de Libertades Públicas en Costa Rica', Revista Jurádica Electrónica (January 1996), < http://www.nexos.co.cr/cesdepu/revelec/consti.htm>.

42. Equipo, Nizkor (1997), La APDH Promueve un Recurso de Habeas Data (May 1997), < http://www.derechos.org/nizkor/arg/apdh/habeas.html>.

43. Calloni, Stella (1994), 'Los Archivos del Horror del Operativo Cóndor', Published originally in CovertAction Magazine (August 1994), < http://www.derechos.org/nizkor/doc/condor/calloni.html>.

44. Verbitsky, Horacio (1998), 'El Camino de la Verdad', Página 12 (October 16 1998), < http://www.pagina12.com.ar/1998/98-10/98-10-16/pag02o1.htm>.

45. This is a general view, see on that respect: Cameron, E and Hegarty, C (1996), 'Never Mind the Quality, Feel the Width:A Sceptical View of Legal Interference with Cyberspace', 10, International Review of Law Computers and Technology 79.

46. European Council. Directive 95/46/EC, Article 26 (4).

47. The Data Protection Act 1998, Schedule 1, Part 1, Section 8, < http://www.hmso.gov.uk/acts/acts1998/19980029.htm>.

48. European Commission. Data Protection: Background Information (3 November 1998), < http://europa.eu.int/comm/internal_market/en/media/dataprot/backinfo/info.htm>.

49. European Commission. Transfers of Personal Data to Third Countries: Applying Articles 25 and 26 of the EU data protection directive (24 July 1998), < http://europa.eu.int/comm/internal_market/en/media/dataprot/wpdocs/wp12en.htm>.

50. European Commission. Transfers of Personal Data to Third Countries: Applying Articles 25 and 26 of the EU Data Protection Directive. Op. Cit.

51. See several documents from the Working Party, < http://europa.eu.int/comm/internal_market/en/media/dataprot/wpdocs>.

52.This is also made evident with further discussions with Switzerland and Hungary. See European Commission. Data Protection: Commission Adopts Decisions Recognising Adequacy of Regimes in US, Switzerland and Hungary (27 July 2000), < http://europa.eu.int/comm/internal_market/en/media/dataprot/news/safeharbor.htm>.

53. European Commission. Opinion 1/2001 on the Draft Commission Decision on Standard Contractual Clauses for the Transfer of Personal Data to Third Countries under Article 26(4) of Directive 95/46 (26 January 2001), < http://europa.eu.int/comm/internal_market/en/media/dataprot/wpdocs/wp38en.htm>.

54 . European Commission. Draft Commission Decision pursuant to Article 26 (4) of the Directive 95/46/EC on Standard Contractual Clauses for the Transfer of Personal Data to Third Countries (19 January 2001), < http://europa.eu.int/comm/internal_market/en/media/dataprot/news/clauses.htm>.

55. Congreso Nacional de Chile (1999), Ley sobre protección de la vida privada No.19628 (30 August 1999), < http://www.ulpiano.com/Recursos_Privacidad_LeyChile.html>.

56. Herrera Bravo, Rodolfo (1998), 'Breves Antecedentes Sobre el Proyecto de Ley de Protección de Los Datos Personales en Chile', Boletin Hispanoamericano de Informática & Derecho (November 1998), No.5, <http://members.theglobe.com/boletin/bol5.htm>.

57. Palazzi, Op. Cit.

58. Congreso de Argentina. Ley de protección de datos. Op. Cit.

59. Cafferata, Fernando (1998), Análisis Crítico de los Proyectos Legislativos de la Argentina. La Nueva Ley de Datos Personales y de Hábeas Data (October 1998), < http://www.it-cenit.org.ar/Publicac/PeopleBases/Recopilac/Recopilac7.htm>.

Bibliography

Asamblea Legslativa de Costa Rica (1989), Ley de la Jurisdicción Constitucional (Ley No. 7135, del 19 de octubre de 1989).

Aveleyra, Antonio (1996), Propuesta Legislativa de Nuevos Tipos Penales en Relación con la Informática, < http://www.inegi.gob.mx/pdi/nv/asesoria/foro/temas6/propinf.htm>.

Base de Datos Políticos de las Américas (1993), Constitución Política del Perú, 1993 (July 1st, 1993), Art.2, Section 6, translated by the author of this essay, < http://www.georgetown.edu/pdba/Constitutions/Peru/peru.html>.

Cafferata, Fernando (1998), Análisis Crítico de los Proyectos Legislativos de la Argentina, La Nueva Ley de Datos Personales y de Hábeas Data (October 1998),
< http://www.it-cenit.org.ar/Publicac/PeopleBases/Recopilac/Recopilac7.htm>.

Calloni, Stella (1994), 'Los Archivos del Horror del Operativo Cóndor'. Published originally in CovertAction Magazine (August 1994), < http://www.derechos.org/nizkor/doc/condor/calloni.html>.

Cameron, E and Hegarty, C (1996), 'Never Mind the Quality, Feel the Width: A Sceptical View of Legal Interference with Cyberspace', 10, International Review of Law Computers and Technology 79.

Charlesworth, Andrew (2000), 'Clash of the Data Titans: US and EU Data Privacy Regulation', 6 European Public Law. Pp.253 - 274.

Chirino, Alfredo (1997), 'Las Tecnologías de la Información y el Proceso Penal, Análisis de una Crisis Anunciada', Revista de Ciencias Penales (December 1997), No.14, < http://www.nexos.co.cr/cesdepu/revelec/penal/Chirino14.htm>.

Chirino, Alfredo (1997), Autodeterminacion Informativa y Estado de Derecho en la Sociedad Tecnologica, San Jose, Costa Rica, Edit, CONAMAJ.

Clarín Digital (1996), 'Habeas Data: El Poder Ejecutivo Vetó una Ley Cuestionada por los Bancos', El Clarín Digital, (December 31 1996), < http://www.clarin.com.ar/diario/96-12-31/o-01401d.htm>.

Congreso de Argentina (2000), Ley de Protección de Datos (September 14, 2000), <http://www.ulpiano.com/habeadata_diputados.htm>.

Congreso Nacional de Chile (1999), Ley Sobre Protección de la Vida Privada, No.19628 (30 August 1999), < http://www.ulpiano.com/Recursos_Privacidad_LeyChile.html>.

Congresso Nacional do Brasil (1997), Lei 9507 Regula o Direito de Acesso a Informaçóes e Disciplina o Rito Processual do Habeas Data (November 12 1997), < http://infojur.ccj.ufsc.br/arquivos/Direito_Administrativo/9507-97.htm>.

Constitución Política de Colombia (1997), Art.15, < http://www.georgetown.edu/LatAmerPolitical/Constitutions/Colombia/colombia.html>.

Constitution of the Federal Republic of Brazil (1988), Art.5, Section LXXI, < http://www.georgetown.edu/LatAmerPolitical/Constitutions/Brazil/brtitle2.html>.

Corte Constitucional (Colombian Constitutional Court), Sentencia No.SU-082/95, < http://www.ulpiano.com/Recursos_Privacidad_colombiaSu082-95.htm >.

Ekmekdjian, Miguel Ángel (1996), El Derecho a la Intimidad Frente a la Revolución Informática, Editorial Depalma, Buenos Aires.

Equipo, Nizkor (1997), La APDH Promueve un Recurso de Habeas Data (May 1997), < http://www.derechos.org/nizkor/arg/apdh/habeas.html>.

European Commission (1998a), Transfers of Personal Data to Third Countries: Applying Articles 25 and 26 of the EU Data Protection Directive (24 July 1998), < http://europa.eu.int/comm/internal_market/en/media/dataprot/wpdocs/wp12en.htm>.

European Commission (1998b), Data Protection: Background Information (3 November 1998), < http://europa.eu.int/comm/internal_market/en/media/dataprot/backinfo/info.htm>.

European Commission (2000), Data Protection: Commission Adopts Decisions Recognising Adequacy of Regimes in US, Switzerland and Hungary (27 July 2000), < http://europa.eu.int/comm/internal_market/en/media/dataprot/news/safeharbor.htm>.

European Commission (2001a), Draft Commission Decision Pursuant to Article 26 (4) of the Directive 95/46/EC on Standard Contractual Clauses for the Transfer of Personal Data to Third Countries (19 January 2001), < http://europa.eu.int/comm/internal_market/en/media/dataprot/news/clauses.htm>.

European Commission (2001b), Opinion 1/2001 on the Draft Commission Decision on Standard Contractual Clauses for the Transfer of Personal Data to Third Countries Under Article 26(4) of Directive 95/46 (26 January 2001), < http://europa.eu.int/comm/internal_market/en/media/dataprot/wpdocs/wp38en.htm>.

European Council (1981), Council of Europe Convention for the Protection of Individuals With Regard to Automatic Processing of Personal Data, < http://europa.eu.int/comm/internal_market/en/media/dataprot/inter/con10881.htm>.

European Council (1996), Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, < http://europa.eu.int/eur-lex/en/lif/dat/1995/en_395L0046.html>.

Falcón, Enrique (1996), Hábeas Data: Concepto y Procedimiento, Editorial Abeledo Perrot, Buenos Aires.

González Murúa, Ana Rosa (1994), El Derecho a la Intimidad, el Derecho a la Autodeterminación Informativa, Instituto de Ciencias Sociales, Barcelona.

Guadamuz, Andres (2000), 'Habeas Data: The Latin-American Response to Data Protection', 2000 (2) The Journal of Information, Law and Technology (JILT), < http://www2.warwick.ac.uk/fac/soc/law/elj/jilt/2000_2/guadamuz>.

Herrera Bravo, Rodolfo (1998), 'Breves Antecedentes Sobre el Proyecto de Ley de Protección de los Datos Personales en Chile', Boletin Hispanoamericano de Informática & Derecho (November 1998), No.5, <http://members.theglobe.com/boletin/bol5.htm>.

Herrera, Berlioth (1998), Freno a Hábeas Data, La Nación (August 5th, 1998), < http://www.nacion.co.cr/ln_ee/1998/agosto/25/pais4.html>.

Hoyos, Arturo (1997), '¿Adónde van nuestras democracias?', El Panamá Améríca, (January 29 1997), < http://www.epasa.com/El_Panama_America/archive/012997/opinion1.html>.

ICL, Constitution of the Argentine Nation (1853), translation by the Argentine congress, Art.43, <http://www.uni-wuerzburg.de/law/ar00000_.html>.

ICL, Paraguay Constitution (June 20th 1992), translated by Peter Heller, Art.135, <http://www.uni-wuerzburg.de/law/pa00t___.html>.

IFEX (1995), Habeas Data Law Modified and Approved (April 1995), <http://holland.ifex.org/alert/00000712.html>.

La Nación (1998) (Editorial), 'Un Proyecto Descaminado', La Nación (August 1st, 1998), < http://www.nacion.co.cr/ln_ee/1998/agosto/01/opinion1.html>.

Mavcic, Andre, Individual Complaint Proceedings Before Constitutional Courts, <http://www.vcilp.org/us/map/powers/compl.html>.

Mendez, William (1998), 'Recurso de Hábeas Data: Ley Limita Divulgar Datos Privados', La Nación (July 30th, 1998), < http://www.nacion.co.cr/ln_ee/1998/julio/30/pais4.html>.

Palazzi, Pablo (2000), 'Protección de Datos Personales, Privacidad y Habeas Data en América Latina', Ulpiano.com (May 2000), < http://www.ulpiano.com/Recursos_Privacy_LatinAmerica.htm>.

Prescott, Charles A (1998), 'Recent Developments in Latin America and Asia Are Driven by Local Interests and Technology', Privacy & American Business, <http://hudson.idt.net/~pab/global.html>.

Saborío, Rodolfo (1996), 'El Bloque de Libertades Públicas en Costa Rica', Revista Jurídica Electrónica (January 1996), < http://www.nexos.co.cr/cesdepu/revelec/consti.htm>.

The Data Protection Act 1998, Schedule 1, Part 1, Section 8, < http://www.hmso.gov.uk/acts/acts1998/19980029.htm>.

Torres, Carlos (1994), 'El Habeas Data en el Extranjero', El Peruano (June 30th, 1994), <http://www.asesor.com.pe/teleley/p3511.htm>.

Verbitsky, Horacio (1998), 'El Camino de la Verdad', Página 12 (October 16, 1998), < http://www.pagina12.com.ar/1998/98-10/98-10-16/pag02o1.htm>.