The general rule for the treatment of personal data under the DPL is that consent to process is a requirement. Consent is valid when there is a manifestation of free will, in an unequivocal, specific and informed manner, whereby the data subject consents to the treatment of personal data concerning him or her.

The DPL provides that the treatment and transfer of personal data is illegal when the data has not consented to such usage, unless an exception is provided by law.

For purposes of the foregoing, the DPL defines treatment as operations and procedures (electronic or otherwise), that allow for the:

• Collection
• Storage
• Organization
• Modification
• Evaluation
• Destruction
• In general, the processing of personal data, or
• Its transfer to third parties via communications, interconnections or transfers

Exceptions to the requirement to obtain consent include, among others:

• When the data is obtained from a public source
• When the data is obtained for the exercise of public duties or pursuant to a legal obligation to do so
• When the data is obtained for marketing purposes and is limited to certain basic information (eg, name, ID, passport, tax ID)
• The data derives from a commercial, employment or contractual relationship, or from a professional or scientific relationship with the data subject, and is necessary for its development or compliance