Cuba Passes New Comprehensive Data Privacy Law

On August 25, 2022, the Republic of Cuba joined the ranks of the multitude of countries around the world that have enacted new data privacy legislation in the past decade. To this point, Law 149/2022 on Personal Data Protection was enacted for the purpose of safeguarding the personal information of Cuban citizens, in accordance with Article 97 of the Constitution of the Republic of Cuba which recognizes the individual right to privacy. With all this being said, Law 149/2022 on Personal Data Protection establishes the legal framework that businesses and organizations must abide by when collecting and processing the personal data of Cuban citizens, as well as the punishments that can be imposed against entities that fail to comply with this legal framework.

What is the scope and application of the law?

As it concerns the scope and application of Cuba’s Law 149/2022 on Personal Data Protection, the law applies to “natural persons insofar as it protects their personal data, and legal and natural persons when they are carrying out processing activities. It addresses the protection of personal data belonging to deceased persons, persons with disabilities, and minors under specific circumstances. To supplement this, the Regulation applies to public telecommunications and ICT service providers and operators. Materially, the Law establishes principles and procedures to ensure that natural persons may enjoy the protection of their personal data contained in records, files, archives, databases, or any other technical means of data processing, either by private or public bodies, and whether in physical or digital form (Article 1(a) of the Law).”

What are the duties of data controllers and processors under the law?

Much like other major data protection laws that have been passed around the world in recent years, including the European Union’s General Data Protection Regulation (GDPR), among others, Cuba’s Law 149/2022 on Personal Data Protection mandates that businesses and organizations adhere to various data protection principles when collecting personal information from citizens of the country. To this end, these data protection principles include the following:

• Collection limitation.
• Data quality.
• Purpose specification.
• Use limitation.
• Legitimacy.
• Security safeguards.
• Transparency.
• Individual participation.
• Responsibility and accountability.
• Legality.
• Confidentiality.
• Consent.

What are the rights of data subjects under the law?

On the other end of the spectrum, Cuba’s Law 149/2022 on Personal Data Protection also affords citizens of the nation numerous rights as it pertains to the collection, processing, and security of their personal information. Likewise, these data protection rights include:

• The right to access any personal information that has been collected or processed concerning them.
• The right to rectify any personal information that has been collected or processed concerning them.
• The right to request that their personal data be deleted if the purpose for which it has been obtained is complete.
• The right to oppose any processing of their personal data that could cause them personal harm.
• The right to oppose automated decision-making.

Conversely, the various provisions of Cuba’s Law 149/2022 on Personal Data Protection are enforced by the nation’s Ministry of Justice. This being the case, data controllers and processors that fail to maintain compliance with the provisions of the law are subject to a wide range of monetary fines and administrative penalties. Subsequently, businesses and organizations that are found to have violated the law are subject to a monetary fine of up to CUP 20,000 (1), as well as the suspension of the databases they use to manage and store the personal data of Cuban citizens. Moreover, the law also gives Cuban citizens the right to bring civil actions against data controllers and processors they suspect have violated the rights they are guaranteed under the law.

With the recent passing of Cuba’s Law 149/2022 on Personal Data Protection last month, residents of the country were granted an extended level of data and personal privacy protection. As online accessibility and digital communication only stand to increase in the upcoming years, these data protection rights are of the utmost importance, as businesses and organizations are now collecting data from consumers in a manner that has never been witnessed before in human history. For this reason, nations around the world must continue to alter the ways in which they secure the personal data of their citizens.