On December 25th, 2020, the Peruvian Personal Data Protection Authority (the “Peruvian Authority”), published Ministerial Resolution No. 0326-2020-JUS, which approved the document ‘Methodology for Setting Fines for Personal Data Matters’ (the “Methodology”).
According to the Methodology, the sanctioning capacity of the Peruvian Authority, granted with the purpose of deterring the o ender and others from conduct prohibited by the Peruvian Personal Data Protection Law,[1] must be subject to clear guidelines on how to calculate fines for infractions to data protection regulation.
Below is a summary of the Methodology’s principal aspects:
1. General Formula to Estimate Fines
In application of the principles of proportionality, reasonableness, and predictability, [2] as well as the aforementioned deterrence effect, the Methodology imposes a general formula to estimate fines.
2. Factors of the General Formula
2.1 Applicable fine (F)
The use of the formula for each specific case will result in the applicable fine (F), which is bound to comply with two (2) requisites: (i) it must be within the quantitative limits established by the Peruvian Personal Data Protection Law; [3] and (ii), it should not exceed the 10% cap of annual gross income reported by the infringer during the last financial year.
2.2 Base amount of the fine (Ba)
The base amount of the fine (Ba) is established by considering two (2) subfactors: the illicit benefit or the avoided cost (i), and the probability of detecting the prohibited conduct (p).
– The first subfactor (i) refers to both the illicit benefit and the avoided The illicit benefit is understood as an increase in income from the commission of an o ense. Conversely, the avoided cost is defined as the savings earned by not investing in resources to comply with data protection regulation.
– The second subfactor (p) refers to the probability that the Peruvian Authority detects an infraction of the data protection regulation, meaning that any increase in these probabilities of detection will be reflected by a decrease in the applicable fine. The Methodology establishes four (4) levels of probability, rated from ‘Very high’, to ‘Low’.[4]
As noted by the Methodology, for various procedures on data protection matters, the first subfactor –the illicit benefit or the avoided cost (i)– might be undeterminable, or it may be inefficient to determine said subfactor due to administrative costs.
Therefore, two formulas are established to determine the Base amount of the fine (Ba):
a) Pre-established fines: This formula is used when the illicit benefit or the avoided cost cannot be estimated, or if the committed infraction is qualified as minor or serious.[5] It comprises a previously assigned value related to the severity of the damage to the protected legal right, as detailed in the Methodology’s
b) Ad-hoc fines: This formula is used when the infraction causes a significative harm to the data subjects, generates an illicit benefit or avoided cost that can be calculated, or if the committed infraction is qualified as very serious.[6] The base amount of the fine (Ba) is calculated by dividing the illicit benefit or avoided cost (i) by the probability of detecting the prohibited conduct (p).
2.3 Aggravating or attenuating circumstances (C)
The third and final factor, (C), is applicable for both pre-established fines and ad-hoc fines.
In accordance with Peruvian regulation,[7] the Methodology considers the sum of four (4) previously assigned values for the aggravating or attenuating circumstances related to the infringement: the economic damage it causes (C1), its recurrence (C2), its circumstances (C3), and the intentionality of its commission (C4).
3. Practical Application of the General Formula
– As an example of a pre-established fine is the Base amount of the fine (Ba) for the illegal conduct of ‘not asking for the consent of the data subject before processing its non-sensitive personal data,’ which is approximately USD 27,348.00 (Twenty-Six Thousand Seven Hundred Twenty-Six and 00/100 United States Dollars). The specific conditions of each case will determine the addition of aggravating or attenuating circumstances.
– On the other hand, it must be stated that the application of an ad-hoc fine requires that the subfactors (i) and (p) are well defined by the Peruvian Authority. For example, if the first subfactor was deemed as an illicit benefit of USD 100,000.00 (One Hundred Thousand and 00/100 United States Dollars), and the second subfactor was deemed as a ‘Very High’ probability of detection (100%), the Base amount of the fine (Ba) for this infraction would still be USD 100,000.00 (One Hundred Thousand and 00/100 United States Dollars). Additionally, the specific conditions of this case would determine the addition of aggravating or attenuating circumstances.
The Methodology will take effect within thirty (30) calendar days counted from the day following its publication date, in which it will be applicable to all Peruvian sanctioning data protection procedures, including those in process.
[1] Law No. 29733. [2] Developed in the Peruvian Law for General Administrative Procedures, Law No. 27444. [3] The quantitative limits are established according to the severity of the inflicted damage to the protected legal right. Minor infractions are sanctioned up to 5 Tax Units (approximately USD 6,077.00), serious infractions are sanctioned up to 50 Tax Units (approximately USD 60,773.00), and very serious infractions are sanctioned up to 100 Tax Units (approximately USD 121,547.00). [4] “Very high” is 100%, “High” is 60%, “Medium” is 30% and “Low” is 10%.
Although this is the general rule, exceptionally, if it is considered relevant and the information available allows estimating the illicit benefit or the avoided cost, fines for serious infractions could be estimated with the ad-hoc fines methodology (not with the pre-established one).
[5] In case it is not possible to determine the illicit benefit or the avoided costs for a very serious infraction, the pre-established fine formula shall be applied. [6] Law No. 27444. [7] Considered only in a qualitatively sense.