Consent

May consent be used as a legal basis for processing worker information? (Y/N – if N, please explain)

Yes. Consent can be used as a legal basis for processing information, but employer must require specific information (not general), purposes of the requirement and time which information will be in possession of employer.

Are there any specific worker data collections or processing operations that require prior consent? (Y/N – if Y, when is consent required)

YES. All personal information.

Are there exceptions that will allow employers to collect and treat workers data without consent? (Y/N – if Y, list the exceptions)

YES. If data processing is required due to legal obligation of the controller.
If data processing is required due to judicial order.
If data processing is required to accomplish public interest or public capacities granted to the controller.
For the execution of pre-contractual measures by request of the data owner or for the fulfilment of contractual obligations pursued by the processing controller.
In order to protect vital interests (considered among them: life, health or integrity) from the data owner or other person. .
If personal data is accessible through a public source.
For legitimate interests from the data controller or a third party (only if rights or interests from data owner are not opposed).Data in public records; information required in a judicial or legal procedure.

Privacy Notice

Is the company required to provide a privacy notice to workers? (Y/N)

YES

Does the worker privacy notice need to address security measures?

YES

Are there any other unique disclosure requirements with respect to the privacy notice (e.g. list data retention periods, state legitimate bases, etc.)?

YES. Mentioned Before.

Data Subject Rights

Are there data subject rights for workers? (Y/N – if Y, please list)

Non especific. General laws.

What is the timeframe to respond to data subject requests from workers?

Data protection laws are new in Ecuadorian legislation. No ruling has been issued yet.

Are there exceptions to responding to data subject requests from workers?

Data protection laws are new in Ecuadorian legislation. No ruling has been issued yet.

Special Rules for Worker Information

Are there employment rules about privacy-related discrimination (e.g., unlawful to terminate employment due to worker submitting an access request)?

There are no specific rules regarding data but discrimination laws are enforceable.

Are there any unique requirements for transfers of employee information to third parties (i.e., contractual restrictions or otherwise)?

Yes. in such case employer must have the consent of employee to transfer data. this under general data protection laws. information to foreign employers must be kept under Ecuadorian regulations.

Are there rules about automated decision making involving workers (e.g., hiring decisions)?

General laws. Decision based on automated processes are prohibited.

Are there rules about processing sensitive information or information about worker households or families (e.g., biometric data, health/medical information, sexual orientation, religious affiliation, union membership, etc.)?

Yes, specially medical and gender information

Are there specific security requirements for storing and processing worker information?

General laws. (Data protection new law).

Are there rules about using worker information for marketing?

Yes. This can only be used with workers consent.

Are there rules about surveillance of workers?

Not public laws but internal regulations.

Are there other specific privacy rules or issues involving worker information (e.g., BYOD policies, monitoring technology use, automated tracking of workers)?

no. Just private rulings authorized by labor ministry.

Government and Recourse

Is there a legislative body or government entity that regulates employment-related privacy matters?

Not in a specific labor mater relation, but we have an organism called “Authority for the Protection of Personal Data, (Autoridad de Protección de Datos Personales) that could include labor relations.

In the event of a violation, is the recourse regulatory, a private right of action, or other?

Both.

Expected Changes to Worker Privacy Laws:

No.

B2B Data

Is business-to-business (B2B) data treated differently than consumer or employee data? (Y/N – If yes, please explain).

No.

Additional Notes:

The law that regulates privacy matters has been issued in May 2021, there are no references about is applicability yet. The regulations for the law must be issued soon.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.