Punitive dosimetry and proactive accountability: The Sanctioning Regime for Personal Data Processing in Ecuador

Abstract

The enactment of the sanctioning regime under Ecuador’s Organic Law on Personal Data Protection in May 2023 marked the commencement of the sanctioning activities of the Superintendence of Personal Data Protection. This study examines the application of the sanctioning regime through an analysis of the first four administrative resolutions issued against the Ecuadorian Professional Football League and the Ecuadorian Football Federation, employing a qualitative, dogmatic-legal approach with a multiple case study design. The findings reveal that the Superintendence has consistently applied the criteria related to the gravity of the infringement, the seriousness of the conduct, the degree of intent, and reiteration, distinguishing between minor and serious infringements. It utilizes an algorithmic system called MPRIV-1, which reduces discretion through a Monte Carlo probability distribution curve. It is concluded that these initial resolutions consolidate an administrative doctrine that materializes the principles of proactive accountability and data protection by design, thereby establishing predictable criteria for data controllers.