Giving our Identity Card number, address, email, photo or any other personal information is becoming more and more common for citizens; although the relevance of such personal information is often only considered when it falls into the hands of unscrupulous individuals.

Precisely, and to protect such personal data, the Cuban Parliament passed last May the Law on Personal Data Protection. It is the first of its kind in the country's legislative history and undoubtedly marks a milestone in the evolution of domestic jurisprudence, emphasizes Doctor in Legal Sciences Zahira Ojeda Bello.

The academic, who in 2020 successfully defended her doctoral thesis on the legal regulation of personal data in Cuba, comments that "our country is no stranger to the process of technological development that has been experienced worldwide in recent years". She adds, " in 2017, it perfected the strategy of virtualization of society, but coupled with this there is also a projection of affirming it from the legal point of view".

Among other reasons, she warns, this interconnection brings with it situations that are not always happy for the users of these platforms. A very notorious case, although not the only one, occurred in 2011 when an installer named Directorio Telefónico QVA2011 appeared that gave access to the cellular and landline numbers, home address, name, surnames, or Identity Card of tens of thousands of Cuban telephone line holders. Most of those who used it, seduced by the novelty, did not realize that they were using data extracted from the files of the Cuban Telecommunications Company S.A. (ETECSA, by its acronym in Spanish), without their consent, much less that of those involved.

In the Magna Carta proclaimed in 2019, Zahira explains, Cuba raised to constitutional rank the right of individuals to the protection of personal data, access to public information, privacy, honor, self-image, identity, and voice. However, this step required complementary legislation; and that is exactly what is happening now.

- Doctor, what solution does this personal data law come to give them to that reality we are talking about? What value does it have for citizens?

"It means that we are defending the content of this right and the specific guarantees. We are outlining its principles. In other words, it is the way to expand the constitutional content so that it is not only exercised but that when it is violated in both an analog and a digital environment, the holder of that personal data has sufficient guarantees to protect it."

"Before this law was passed, the holders of such data, natural persons did not have a place, space, or entity either in the administrative or judicial order, to which to turn in the event of an affectation to access their personal information; to modify, change or update it."

"It was what happened with the telephony database, which for some unexplained reason was leaked. That had no transcendence, apparently, but when people sign a contract they are assigning that information with a specific use; and that entity or any institution is responsible not only for the storage of this; but also for its custody and use it only for what it was assigned for."

"Then, by the simple fact of having been used by other people with whom we did not make that contract, and who could make use of these to carry out conducts that may constitute a crime, the right of the holder of the personal information is being violated. In addition, the person responsible for the custody, storage, or processing of such personal information would be in breach of a previously acquired contractual obligation. All this is valid in digital platforms as well as in traditional platforms."

"This law mandates state or private institutions and self-employed workers to make use, storage of that personal information that we have provided for a specific purpose and that cannot be sold or exchanged. In addition, it establishes the obligation to inform the holder of such personal data, first of all, that the information will be used later and that only the holder may decide or authorize if he/she agrees with the use of such information for another type of purpose."

- Could this law be an additional contribution to people's legal culture?

"Of course; because it will require both the population and society as a whole to be aware of the responsibility that corresponds to them in the use of our personal information. A responsibility that goes in both directions, because the law gives a group of guarantees, but everyone must be aware that it is up to them to protect their information first."

"Also this law is not designed only for the problems, or at least I think it should not be analyzed only from the perspective of what happens in digital environments. The right to the protection of personal data is not only to ensure the personal information that circulates through digital networks; it is also personal information in a generic sense."

"Then it is applicable, for example, to a medical record that is in physical form and that has to be secured, that cannot be on the table of just anyone; because it is not the doctor's, but the patient's."

"This law must be visualized in labor relations and contractual relations, in the issue of records associated with criminal records. So it is up to these institutions to establish specific regulations to ensure the protection of the personal information that is in their hands, due to the type of relationship held with a natural or legal person."