On 2 November 2026 Argentina's data protection authority, the AAIP, announced its broadest action yet on debt-collection data. It suspended the database of collector 5 ON LINE S.R.L. until its processing complies with Ley 25.326. It opened a formal proceeding (sumario) against RDC Collections and an ex officio investigation into Mercado Pago. It served formal notices (intimaciones) on Estudio Palmero de Belizán & Asociados, GCA Group and Impulsa Partners. It also issued a formal warning (apercibimiento) to Banco de Galicia for failing to supply information in an inquiry into data-suppression duties (AAIP announcement).
This is mostly well-aimed enforcement. It also exposes how thin the statute behind it is.
The strongest case for the crackdown
The regulator's case is strong. The 5 ON LINE probe, opened in April 2026, followed complaints that the firm contacted relatives, friends, co-workers and neighbours of debtors (AAIP, 13 April 2026). None of those people owes anything. Their phone numbers were obtained and used for a purpose they never agreed to. They are also being used as social leverage against someone else. Article 4 of Ley 25.326 requires personal data to be accurate, adequate, relevant and not excessive. A neighbour's number held in a collector's database for pressure purposes is hard to fit within that standard.
The AAIP's approach to who is responsible also looks sound. It has said a company that assigns collection to a third party is jointly liable with that third party. Law-firm commentary reads the statute the same way: the recipient of the data carries the same obligations as the assignor (Marval, June 2026). That is the right incentive. Lenders cannot launder bad practices through contractors.
Where proportionality matters
A pro-innovation reading has to separate two things. Debt collection is a legitimate and necessary part of a functioning credit market. Fintech lending in Argentina depends on being able to recover debts at reasonable cost. If recovery becomes impossible, credit gets scarcer and dearer for the borrowers regulators say they want to protect. The harm in the 5 ON LINE case is the contact with uninvolved third parties. Contacting the debtor is not the harm.
The ex officio investigation into Mercado Pago deserves that distinction. The AAIP's announcement describes only the opening of the inquiry, with no findings, and Mercado Pago has not been sanctioned. Proportionate enforcement means the AAIP should publish what it finds. It should say whether the practice was by Mercado Pago, by its contractors, or by neither. Opening an inquiry against one of the country's best-known fintechs signals intent, but a signal is not evidence.
The Banco de Galicia warning points to a more ordinary problem. Article 16 gives people the right to have data rectified, updated and, where appropriate, suppressed. The controller must act within five working days of the request. Failure to do so opens the way to a habeas data action (Ley 25.326, text). The warning reportedly concerns failure to answer the regulator, not a ruling on the underlying deletion duty. Penalising non-cooperation with an investigation is fair, and it is also a modest step.
The statute's blunt tools
The suspension of 5 ON LINE's database is the most notable part of the case, and it follows partly from the law's design. Article 31 allows the control body to apply warnings, suspension, fines, closure or cancellation of a database. The fines in the statute's original text run from 1,000 to 100,000 pesos (Ley 25.326, text). The law was enacted in 2000 and its original text has no mechanism for scaling penalties to revenue.
The AAIP does apply the fining power in practice. In 2019 it fined Cencosud 65,000 pesos in total, for one minor and one serious infraction, after the retailer ignored an Article 16 deletion request and the AAIP's own notice (AAIP resolution RS 2019-137). Against a large lender, sums of that order are not much of a deterrent. A database suspension is far more consequential, because it stops the business from operating on that data. That makes it a more effective lever, but also a bluntier one. The company has no clear, published standard for what "compliant" processing looks like, and the AAIP has not set out its criteria for lifting the suspension.
That is a rule-of-law concern as well as a business one. Enforcement that relies on the severest available sanction, because the milder ones are weak, tends to be unpredictable.
What a better framework looks like
The AAIP's announcement points in a useful direction when it encourages professional bodies to draft codes of conduct, as contemplated by Article 30 of the law. For debt collection the mechanism is well suited to the problem. A code could specify:
- Who may be contacted, and a flat ban on contacting relatives, co-workers and neighbours.
- Hours and frequency limits on calls.
- How collectors source contact data and how long they may keep it.
- A standard period for answering Article 16 requests, matching the five-working-day statutory limit.
The credit-reporting rules already show the logic. Article 26 limits the storage and transfer of credit data to significant data from the last five years, reduced to two when the debt is paid or otherwise extinguished (Ley 25.326, text). Time limits that people can understand and enforce work better than open-ended discretion.
Bottom line
The AAIP is right to treat third-party contact as the core harm and to hold lenders jointly responsible. The weaker points are the lack of published findings, the absence of clear compliance criteria, and a legal framework whose penalties barely register. Argentina's data protection regime would be better served by clear standards written with industry than by suspensions applied case by case. Enforcement should follow the evidence, and the Mercado Pago inquiry will show whether it does.