Recently, the National Authority for the Protection of Personal Data (ANPDP) issued Directorial Resolution No. 1022-2022-JUS/DGTAIPD-DPDP, by which it decided to sanction a company for the following:
- Having carried out the processing of the personal data of the workers through the document “employment contract of indefinite duration” without complying with the duty of information on the processing of the same, regulated by the law on the protection of personal data, mainly on the identification of the recipients of the personal data The data.
- Having collected personal data relating to criminal, criminal, police and judicial records, as well as complaints to the public prosecutor, job seekers, having failed to comply with their obligation “not to collect personal data by fraudulent means , unfair and illicit”.
For the Authority, the storage of such information, as well as the extraction or any form of detention, original or temporary, can only be carried out by a public person whose powers confer it on him, the only lawful source of this true and current. personal data; therefore, any act of transfer and receipt by a private entity loses this legitimacy.
Notwithstanding the above, it should be noted that the ANPDP has indicated that it is possible that the contracting company will directly request from the applicant, personal data relating to criminal, police and judicial records, as well as complaints before the Public Prosecutor’s Office , which can then verify the authenticity of the documents received, directly from lawful sources accessible to the public. The situation should be analyzed for each specific case in order to avoid possible violations of any of the provisions established by the Peruvian regulations on the protection of personal data.
The first offense amounted to a fine of 26,712.00 PEN, while the second, a fine of 261,786.00 PEN.
The aforementioned resolution issued by the ANPDP recalls the importance of carrying out adequate processing of the personal data of applicants and workers.