UPAD limited the right to privacy without justification, says expert • Weekly University


President Carlos Alvarado and other officials of the Executive Power have insisted that the now-defunct Presidential Data Analysis Unit (UPAD) was created because it was necessary to have data to make a better public policy, but lawyer Mauricio París Cruz warned that This work did not require access to the personal data of Costa Ricans. In an appearance before the legislative commission that investigates the case, Paris affirmed that with the decree that created the Upad, the Executive Power limited the right to privacy, which is a fundamental right, without any justification. He criticized that the operation of UPAD passed four months – or more – without being public or transparent; and that the Presidency of the Republic is responsible for the use that was given to these data. The lawyer presented his legal assessment regarding the handling of personal data of Costa Ricans in relation to the UPAD case on Thursday in the Legislative Assembly. He said that he considers that a series of errors were made regarding the issuance of decree number 41,996, which created the unit and regarding the treatment of personal data, including sensitive data from Costa Ricans, carried out by the group of people from the Presidential House. “It seems to me that a fundamental right of Costa Ricans could not be limited by means of an executive decree, especially when that limitation did not respond to a weighting rule that would justify why sacrifice a fundamental right of all Costa Ricans against an objective such as to carry out a better public policy, but which does not have a constitutional basis nor is it a fundamental right ”, he pointed out. Paris emphasized that when two fundamental rights collide, one of them must be valued above the other; but that in this case “an attempt was made to sacrifice a fundamental right, the right to privacy, without our having a justification for another fundamental right.” “What is the justification? The fact that the President of the Republic required data to make public policy; That is not a fundamental right, “he stressed. The justification of data for public policies The Public Ministry investigates the Upad case because it handles the initial hypothesis that President Carlos Alvarado, the Minister of the Presidency, Víctor Morales, and the Vice Minister of Planning, Luis Daniel Soto, are suspected of prevaricate (issue resolutions contrary to law) for signing the decree that created UPAD, dissolved after its existence was known through the official newspaper La Gaceta and media publications. According to the statement of facts that is made in the document of the Prosecutor’s Office, between May 2018 and October 2019, the investigated Alejandro Madrigal, Andrés Villalobos and Diego Fernández Montero, serving as data advisers to the office of the presidency, “formed a government unit for the compilation and analysis of personal data of Costa Ricans, with a view to the alleged execution of public policies; the foregoing without any legal backing. ” In his appearance, Paris recounted the explanations that President Carlos Alvarado has given of why UPAD was wanted. “That you can count on data to make better public policy and what they explained from using data to find out where there are more dams, to be able to carry out public works and prioritize public works there. It seems to me that all this is very good and that it should happen. But the problem is having crossed the barrier of personal data. For most of the examples that the President of the Republic used, no personal data is needed, ”he said. The problem, he pointed out, is when the personal data barrier is crossed and data from Costa Ricans is used, since that has to be done through a law and through respect for publicity and transparency. In this sense, he indicated that if there is a treatment of personal data by the State, that treatment must be public and transparent. The decree that created the Upad has an issue date of October 14, 2019; but it was published until February 17, 2020. According to Paris, it has not been able to find another decree in recent times, which would take four months to be published. “For four months UPAD was acting and carrying out personal data treatment, and even much earlier, as has been reported in the press, without this treatment being public and transparent.” As for the people responsible for the operation of the Upad, Paris noted that article 3 of the decree that created it states that the Unit will be a unit “of a strategic political level” that directly advises the President of the Republic and will report to the Presidency of the Republic and that article 8 of the decree says that the head of the Upad responds to the President. «It seems to me that it is clear that the person responsible for the treatment of personal data that has been carried out by this group of people is the Presidency of the Republic. The person in charge is the one who decides with respect to the database, the use it is given and who decides what it will be used for or not. The institution that does this treatment is the Presidency, “he stressed. Mismanagement of the Personal Data Protection Law Paris explained that article 14 of the regulation of the Personal Data Protection Law (8968) provides that the rights associated with informational self-determination can be limited, exclusively in the event that there is a law and a reasoned reasoned resolution; that the Political Constitution establishes a fundamental right to privacy and the Public Administration law says that fundamental rights can only be limited by another law. But that the executive decree of the Upad tried to apply a limitation to a fundamental right only on the basis of a decree; not in a law. “That implies mishandling of matter,” he said. Another point made was that article 8 of the Personal Data Protection Law, was not only “badly planned, but poorly applied.” It has been said that this article allowed the State to limit the rights of the Personal Data Protection Law. But Paris clarified that the article begins by referring to the principles, rights and guarantees established herein. And the same rule responds in the title that refers to the exceptions to the informative self-determination of the citizen and refers to chapter 2 of the Law. “The only thing that can be limited by applying article 8 of the Law on Protection of Personal Data would be what which is included in chapter 2 of the same law. The application of other elements contained in the law cannot be limited and this is very important. Other obligations, such as the rules associated with the transfer of personal data, the rules associated with the security in the processing of personal data or even the rules of which databases should be registered with the Protection Agency of Data of the Inhabitants (Prodhab), cannot be subject to limitation applying article 8 ”, he detailed. Paris is a postgraduate professor at the Law School of the University of Costa Rica (UCR), has a master’s degree from the Carlos III University of Madrid, Spain, is a specialist in personal data protection, representative in Central America of the Latin American Association of Privacy and manager for Latin America of the Spanish firm ECIJA, advising on technology, media and telecommunications. Furthermore, last year he was hired by Prodhab to develop a national privacy strategy, as part of a cooperation with the UK Government. Paris says it handed the strategy over to the Agency since March this year.