The New Law on Credit Protection Information

On September 23, 2020, with the pronouncement of the House of Representatives, the Paraguayan Congress lifted the veto of the Executive Power to Law No. 6534/2020 “of the protection of personal credit information.” Therefore, according to the National Constitution, the Executive Power is obliged to promulgate the law. Consequently, this law will enter into force soon.

The primary purpose of the law is to guarantee the safeguard of individuals and entities’ credit information. As a secondary objective, although equally important, the mentioned law regulates the activities of collection and access to credit information data to preserve the fundamental rights to privacy, informational self-determination, freedom, security, and fair treatment of people.

The law will be mandatory for the treatment of personal data in public and private registries. Therefore, the law’s application scope includes private companies that provide credit information, such as Informconf.

This law regulates everyone’s right to be informed expressly and clearly about the use that will be given to their personal data, the right to forgetting credit information, and the duty of secrecy on the part of the people who have access to this data. Consequently, the person whose data will be collected must express their consent to the obtention and use of their personal data. The collection or transfer of data without the affected party’s authorization will be considered illegal and subject to sanctions.

Seeking to protect sensitive personal data of debtors, such as credit information, this new law requires a reason to access credit information. Therefore, credit information can only be collected within the framework of a business relationship. The use of credit information to make employment decisions, for employment access purposes, or for decisions regarding promotions, transfers, or dismissals of personnel, as well as to deny or restrict access to prepaid medicine or emergency medical care, is prohibited.

Also, the law limits who may have access to credit information, establishing the following institutions or persons as potential users of credit information: (i) financial and credit intermediation entities regulated by the Central Bank of Paraguay; (ii) entities controlled by the National Institute of Cooperatives (INCOOP for its Spanish acronym); (iii) individuals or legal entities whose businesses involve granting credits; (iv) mutual funds, loan houses, and pawnshops; (v) people who are regularly engaged in the sale of products through credits; and, (vi) people who serve as a channel of means of intermediation through the use of technological platforms. This list is exhaustive; therefore, natural or legal persons not included in it may not be credit information users.

Users of credit information must continually update their clients’ data, especially the information regarding the compliance with credit obligations. Indeed, the cancellation of debts must be notified to the institution that registers the data (such as Informconf) within a maximum period of 24 hours after its cancellation.

In the event of non-compliance, the Secretary of Defense of Consumers and Users (SEDECO for its Spanish acronym) may impose administrative sanctions ranging from an express warning to a maximum fine of 15,000 minimum wages in force at the time of the application of the sanction. This penalty could be increased in the event of a repeated offense, elevating to a maximum of 50,000 minimum wages and potentially causing the suspension of the infractor’s activity. The sanctions stipulated in the law will not only apply to the individual that commits the offense but will also be extended to all members of the entity’s administrative bodies unless they prove they had no knowledge of the commission of the infraction or prove that they opposed the activities contrary to the law.

Once the law enters into force, any public or private entity responsible or in charge of credit information services and personal data must adjust its bylaws, organization, and operation to be in conformity with the law’s provisions within 24 months.