The Personal Data Protection Law, approved by the Legislative Assembly of El Salvador on November 12, includes a provision that would allow for the elimination of data online, and from search engines such as Google, that is deemed “inadequate, inexact, outdated, or excessive.” This includes information found in journalistic articles mentioning specific names, facts, and circumstances: Those mentioned will be able to request that Salvadoran authorities remove the information from the internet.
The decision of what information could be eliminated will be made by a new office created by the law, the State Cybersecurity Agency (ACE). The new agency will have the power to classify or declassify information, weighing the interests of the owners of the data and those responsible for administering it.
The law establishes that citizens may request the protection of their data —that is, removal or modification— and that ACE will have broad powers to act, including by sanctioning ex officio those who violate it. The Agency will assume responsibilities formerly held by the Public Information Access Institute (IAIP), which since 2020 has worked to restrict the public’s access to information. Those who do not comply with ACE orders will be sanctioned.
The European Union codified people’s right to eliminate their information from the internet in May 2014. In Europe, the “right to be forgotten” is part of the ARCO-POL framework, which allows, among other provisions, for search engines to no longer display links to certain personal data.
The express approval of the Salvadoran law occurred after just two working sessions in the Assembly, in which the only public opinion was given by the Secretary of Innovation of the Presidency, Daniel Méndez. The IAIP lost many of its faculties but did not publicly participate in the discussion.
The bill that the Ministry of Justice and Security and the corresponding legislative commission had originally prepared included a restriction on access to public records on private individuals, such as the Commercial Record and the Real Estate and Mortgages Record. The press has long used public records to profile public officials who enrich themselves in office. But the point was struck from the bill, just minutes before it became law, at the request of ruling-party legislator Caleb Navarro.
However, freedom of the press, expression, and information could be curbed by other provisions, like those that permit that historical, legal, or judicial information on certain individuals be removed from the internet, search engines such as Google, and even messaging platforms like Telegram. “The right to be forgotten could provoke the exclusion of certain parts of history, or limit the capacity of the press to report on historical events or context with transparency and precision,” digital rights lawyer Nathalie Hernández told El Faro.
In 2017, the Inter-American Commission’s Special Rapporteur for Freedom of Expression stated that removing content from the internet cannot be used as a mechanism to protect individuals’ honor or reputation; the right to rectification and response, as well as civil suits, exist to correct information considered false, damaging, or inexact.
The new law enshrines the “principle of exactness.” Article Five states that “all reasonable measures will be taken without delay to erase or rectify personal data that is inexact relative to the purposes in question.” White Article 10-C reads that any “request to cancel or erase [data] will not proceed when necessary to exercise freedom of expression, information, and the press,” it adds a caveat: “The data used in these cases must meet the principle of exactness; personal data that is inexact, incomplete, or outdated must not be used or shared.”
“How can the standard of exactness be met if they [public officials] block you [journalists] on social media?” asks René Valiente, the former head of the public information access unit of IAIP. “Journalists will need to take care to not publish personal information. And what do we understand by personal data? The new interpretation of the IAIP says that even giving public employees’ names was impossible for that reason.”
The digital rights attorney Hernández agrees that the requirement that the press only divulge “exact” information could run up against press freedom as information becomes less precise over time: “In order for you to do your jobs, sometimes you need to find bits of information that give meaning to other data.”
According to the Salvadoran Journalists’ Association (APES), the risk to freedom of expression, press, and information lies in the “establishment that those who exercise freedom of expression or information are submitted to the same standards and demands as [the administrators] of databases with Salvadorans’ personal information.”
The APES says there is sufficient legal precedent stating that journalists’ only requirement is to not knowingly report false information or publish with an evident disregard for the truth. The association says that this is why verification and contrasting of sources are among the basic principles of journalism.
Their concern is not unfounded. In 2021, a court forced the digital magazine Revista Factum to remove from the internet reporting on the discovery of a clandestine grave implicating a police officer.
In April, Google began operating in El Salvador following an announcement by President Bukele last year of a $500-million-dollar public contract to modernize government services. The company stated that it would work “to develop simple digital ecosystems for import, export, health and sanitary registration”, and mentioned that it had already begun to train healthcare personnel on handling patient information stored in remote servers referenced as “cloud technologies”, and to create a telemedicine platform.
The law approved by the Bukele-controlled legislature is nearly identical to a draft promoted six years ago by the party Arena, and which Bukele sent back to the Assembly with observations. Now, specialists like Hernández believe that the approval of the bill is related to recent events including Google’s arrival in El Salvador and the massive leaks of personal data through hacker groups such as CiberinteligenciaSV. “I wonder: Who is the government trying to show that they respect the right to data protection?”
