El Salvador 's recently approved cybersecurity and data protection laws contain sweeping provisions that threaten media freedom and privacy rights, Human Rights Watch said today.
El Salvador's Legislative Assembly, dominated by President Nayib Bukele's party, Nuevas Ideas (New Ideas), approved both laws on November 12, 2024. The cybersecurity law establishes a State Cybersecurity Agency (Agencia de Ciberseguridad del Estado), led by a presidential appointee, to oversee both cybersecurity and data protection. The data protection law creates a "right to be forgotten," which as drafted gives the agency overly broad powers to order the deletion of information about individuals online.
"These new laws could be used to delete online publications that are critical of the government under the guise of data protection," said Juanita Goebertus, Americas director at Human Rights Watch. "This is a recipe for censorship and opacity."
Under the cybersecurity law, the new government agency develops national policy, manages cyber threats, conducts oversight, and imposes sanctions. It also supervises data protection compliance, issues guidelines, and resolves disputes. The agency's general director, appointed by the president for a renewable three-year term, serves as its highest authority.
Based on the United Nations Human Rights Council Resolution on the Right to Privacy in the Digital Age, governments should establish national independent authorities to protect private data. These authorities should have the capacity to monitor data privacy practices, investigate violations and abuses, receive communications from individuals and organizations, and provide effective remedies for violations.
The data protection law's "right to be forgotten" allows individuals to request the removal of their data from the internet, including search engines and even media outlets, when such information is "inadequate, inaccurate, irrelevant, outdated or excessive." While the law excludes deletion of personal data that is "necessary for the exercise of the right to free expression, information and the press," this exception requires published personal information to be "precise" - that is, data may not be published if it is "inaccurate, incomplete, or out of date." Media outlets and search engines found to violate data protection requirements could face fines of up to 40 minimum monthly salaries.
This requirement could allow the government to pressure media outlets to delete information of public interest about officials or their allies by claiming the information is inaccurate or incomplete, Human Rights Watch said.
The Organization of American States' special rapporteur for freedom of expression has warned that the "right to be forgotten" laws can threaten freedom of expression. While personal data protection is a legitimate aim, it should not be used to restrict the publication of information about public officials or of public interest. The special rapporteur has emphasized that removing online content interferes with both individual expression and society's right to access information, and should only be ordered by courts following due process.
The Global Principles on Protection of Freedom of Expression and Privacy, developed by ARTICLE 19, an independent human rights organization promoting and protecting the right to freedom of expression globally, say that any "right to be forgotten" should be strictly limited to de-listing from search results rather than content removal, should include strong procedural safeguards including appeal rights, and should never override the right to information about government officials or matters of public interest.
The data protection law also excludes from its scope any data or activity focused on furthering "public security, state defense, national security, and crime prevention, investigation, detection and prosecution." While the provision also requires respect for "due process and human rights," this broad exception allows government agencies to publish personal data for undefined security and crime prevention purposes without restriction, putting individuals' privacy at risk.
"In El Salvador's existing context of opacity and harassment of independent journalists and civil society organizations, there is a serious risk these laws could be weaponized to threaten, silence, or hinder freedom of expression and information," said Goebertus.
