The development of the right to personal data protection in Latin America and Peru has experienced significant growth over the past decade, reflecting the increasing interest and concern for privacy and its protection in various fields.
As technology advances and digital media become prevalent and cross-cutting in most daily activities, the protection of personal information has become one of the areas legislators are focusing on, seeking to safeguard users' privacy against fraudulent or unauthorized uses of their information.
One aspect receiving significant legislative attention in the region is the protection of consumers and users against communications for commercial purposes conducted by companies that seek to promote various products or services through telemarketing.
Indeed, most countries in the region have been promoting legislative projects and/or reforms related to personal data protection and privacy, mainly influenced by the provisions of the European Union's General Data Protection Regulation (GDPR).
It is important to note that in our country, until 2018, we had a virtual registry called "Thanks, Don’t Insist," implemented by the National Institute for the Defense of Competition and the Protection of Intellectual Property (INDECOPI).
This registry allowed consumers who wished to do so to register in a list to avoid receiving commercial communications through calls, text messages, or mass emails. However, the platform's low publicity and the lack of an integrated policy for its development over time meant it did not meet its intended purpose.
Thus, between January 2020 and December 2023, the National Institute for the Defense of Competition and the Protection of Intellectual Property imposed only 78 sanctions on 53 providers for unauthorized commercial communications, which evidences a very low application rate by the authority of the legal mechanisms in place.
Later, with the entry into force of Legislative Decree No. 1390, which amended Law No. 29571, Consumer Protection and Defense Code, the virtual registry "Thanks, Don’t Insist" was eliminated, and a prohibition was established on the use of call centers, phone calling systems, text messaging to cell phones, or mass electronic messaging to promote products and services or provide telemarketing services to all phone numbers and email addresses of consumers who have not given prior, informed, express, and unequivocal consent for this commercial practice.
This amendment sought to harmonize consumer protection regulations with personal data protection by allowing an initial contact to obtain consent, as well as establishing the possibility of revoking consent for such communications at any time in accordance with the relevant regulations.
Recently, the draft of Bills No. 2942/2022, 3131/2022, and 3541/2022 was approved, amending subsection e. of Article 58.1 of Law No. 29571, Consumer Protection and Defense Code. This new draft, which is likely to be approved by insistence in Congress shortly, adds paragraph 58.3 to Article 58 of the Code, establishing an absolute prohibition on any commercial practice involving the "use of call centers, phone calling systems, text messaging to cell phones, or mass electronic messaging to promote products and services, as well as providing telemarketing services to any consumer (...)"
The only exception for sending advertising to a consumer provided in this regulatory amendment establishes that the consumer must, on their own initiative, directly contact the provider and express their free, prior, informed, express, and unequivocal consent to be contacted via a phone number, email address, or any other analogous means of communication.
With this amendment to the Code, it would be prohibited to establish initial contact with the consumer to request consent, which contradicts statements from the National Institute for the Defense of Competition and the Protection of Personal Data Authority, which have indicated that the initial contact with the consumer to obtain consent is valid.
In our opinion, this prohibition is disproportionate, as it deprives consumers of valuable information about promotions and offers. The dynamic of initial engagement between provider and consumer benefits both by allowing consumers access to services that may be relevant to them.
While some providers fail to comply with the current provisions regulating commercial communications, it is worth noting that our legal system provides mechanisms that allow users to effectively manage the processing of their information.
Indeed, Law No. 29733, Personal Data Protection Law, and its regulations, among others, recognize the rights of data subjects to request access, rectification, cancellation, and opposition to the data being processed by any provider and establish a penalty regime for non-compliance.
This is a direct and less restrictive mechanism through which the misuse of personal data can be adequately supervised, ensuring that the administrative authority focuses only on cases where there are non-compliance with explicit requirements or where the general interest is affected.
The operational limitations of the authorities designated to assess and sanction practices contrary to our legal system should not justify establishing such a restrictive system as proposed, which would impact the entire telemarketing industry and a significant number of individuals working in this sector.
We believe the solution lies in the active participation of the responsible authorities to promote and empower users in managing their personal information without the need to impose an absolute restriction with significant economic impact on companies seeking to market products through telemarketing.