On 2 November 2026, Argentina's Agency for Access to Public Information (AAIP) opened sanctioning proceedings against the debt collection company RDC Collections. Digital Policy Alert logged the event with the status "under deliberation". Its description says the firm allegedly processed personal data by contacting people unrelated to the debt.
This is an opening, not a finding. I could not locate the AAIP act or Boletín Oficial text, and the Digital Policy Alert entry states no legal basis. The articles of Ley 25.326 invoked are therefore unconfirmed, and nothing below assumes RDC is guilty.
The strongest case for the regulator
Debt collection is a recurring source of privacy harm. A collector who phones a debtor's employer, neighbour or relative discloses the existence of a debt to people with no stake in it. The debtor bears social and sometimes professional costs, and cannot easily undo them. The people contacted never consented to anything, yet their numbers and relationships to the debtor have been processed.
A regulator that ignored this would leave a real gap. Contract law between creditor and debtor does not protect third parties. Data protection law is one of the few tools that does.
What the rules actually say
The AAIP enforces Ley 25.326 through its implementing decree, Decreto 1558/2001. I could only confirm the decree's text, not the statute's own article wording. Three of its provisions bear on a case like this:
- Good faith and purpose (art. 4). The decree says that to judge "lealtad y buena fe" in collecting data, one should examine the collection procedure and the use assigned to the data. Data that has lost relevance to its original purpose must be deleted.
- Informed consent (art. 5). Consent must be preceded by an adequate explanation to the data subject, and can be revoked at any time.
- Debt data (art. 26). Debt-related data may be kept for five years from the last adverse entry showing the debt was enforceable. That drops to two years if the debtor shows the last information coincides with extinction of the debt.
These are the provisions most likely to matter, but that is inference. The allegation as reported could be framed under consent, purpose limitation, or both. Which one the AAIP picks will shape the precedent.
Why the framing matters
The AAIP has recently sanctioned for consent failures. Allende & Brea reports that in February 2025 it fined an unnamed laboratory through Resolución 28/2025. The firm had called a patient from its patient programme and could not show written consent. The agency found two serious infractions and one very serious one, and held that consent "no puede ser presumido ni inferido de actos posteriores".
That reasoning is sound for sensitive health data. Extended mechanically to debt collection, it would be less sound. A collector trying to reach a debtor may legitimately need to confirm a number or ask whether someone can pass on a message. A rule that every contact with a non-debtor requires that person's prior consent would end that practice, and with it much lawful collection. Creditors would shift to litigation, which is slower, costlier, and worse for debtors.
The proportionate line is narrower. A collector may attempt to reach the debtor. It may not disclose the debt, or retain and reuse a third party's data to pressure the debtor. A good decision here would say so explicitly, and it would distinguish an incidental wrong-number call from a systematic campaign of contacting employers and relatives.
Process safeguards are real, and worth defending
The decree gives the accused firm procedural footing. Under art. 31, the alleged infringer has five business days to file a written defence, and the final resolution follows within twenty business days. Fines are graded by the nature of the rights affected, the volume of processing, benefits obtained, intent and recidivism. Recidivism is measured over three years.
Those factors favour a calibrated outcome. A company with a handful of misdirected calls should not face the same treatment as one that built a business model on shaming. The AAIP's sanctions register is also administrative infrastructure: Resolución 179/2025, published on 30 September 2025, amended the file-keeping rule for the Registro de Infractores that records sanctions, so outcomes are logged and visible to future decisions.
What to watch
- Publication. The final resolution should state the legal basis and the facts found. Without that, other collectors cannot tell what conduct was actually penalised.
- Calibration. Whether the AAIP separates incidental third-party contact from systematic disclosure.
- Consistency. Whether it treats consent as the universal test, as in the laboratory case, or applies purpose limitation to a different fact pattern.
- Registry use. Whether the outcome is entered in the infractions registry that Resolución 179/2025 governs.
The bottom line
Protecting people who owe nothing from being drawn into a stranger's debt is a legitimate task for a data protection authority, and it does not need a new law. It needs a clear, reasoned, published decision that tells collectors where the line sits. Argentina's pro-innovation interest lies in predictability: a credit market works when lenders can recover money by lawful means and when everyone knows what lawful means. This case is a chance to establish that. The risk is a decision that is vague on legal basis and broad on consent, which would chill ordinary collection while giving the worst actors little new guidance.