This Monday, members of El Salvador’s National Security and Justice Committee in Congress issued a favorable opinion for two legislative projects: the “Cybersecurity and Information Security Act” and the “Personal Data Protection Act.”
Prior to approval, lawmakers heard from the Secretary of Innovation, Daniel Ernesto Méndez Cabrera, who explained that the Cybersecurity and Information Security Act aims to “establish principles, a legal framework, institutional structures, and protection policies to organize, oversee, regulate, and audit cybersecurity and information security measures for public institutions.”
Méndez also detailed that the Personal Data Protection Act seeks to safeguard personal data by establishing essential requirements for its legitimate processing, along with standards for collection, usage, processing, storage, and related activities.
According to Méndez, combining the two laws would allow citizens to request search engines to remove certain information from public access. “Often, personal data is leaked and spread, but now it will be possible to ask search engines to remove it,” Méndez explained.
Furthermore, Méndez noted that both laws provide for the creation of the State Cybersecurity Agency, which will act as the governing body for cybersecurity and data protection. “This legislative framework establishes the State Cybersecurity Agency, which will oversee cybersecurity and data protection. Our goal is to ensure Salvadoran citizens’ rights to control and manage their data. The agency will set minimum cybersecurity protocols that public and private sectors must follow to protect the public’s information,” he stated.
Committee President, Congressman Caleb Navarro, raised questions about the potential inclusion of data from the National Registry Center (CNR), specifically property and mortgage information. Navarro noted that such data, which includes personal information, is publicly accessible and inquired about how this would be handled under the new law.
In response, Méndez clarified that the CNR would indeed be subject to the new data protection law, noting that the draft legislation does not exclude public records from its regulations.
Certain exclusions apply under the Personal Data Protection Act, including:
• Credit history data
• Domestic and family matters
• Public safety or defense issues
• State family records
Both bills are set for approval in the 29th regular plenary session next Tuesday.