Argentina's Agencia de Acceso a la Información Pública (AAIP) has spent October celebrating a decade of Ley 27.275, the access-to-information law. The agency, led by Beatriz Anchorena, says its Transparency Index rose from 44.6 to 67.7 points between the first halves of 2024 and 2026 and that its response rate reached 95%. Those are the agency's own figures, and we could not independently check them. If they hold, they are a real achievement. They also sharpen a question the anniversary events only touched on: the same agency regulates personal data under a law passed in 2000, and the bill to replace that law is still stuck.
The case for the regulator's ambitions
The strongest argument for a rapid overhaul is simple. Ley 25.326 was sanctioned on 4 October 2000, before smartphones, social platforms or machine-learning systems existed. Its Article 12 bans transfers of personal data to countries or bodies without adequate protection, and the AAIP's first listed priority is adequate international data flows. A regulator that wants Argentina's framework to be recognised abroad has a legitimate complaint if the statute it enforces predates most of the technologies it must supervise. Children's online safety and AI are real gaps, and a modern statute would give businesses and citizens clearer rules than improvisation through agency guidance.
What the pending bill actually does
On 16 July 2026 Deputy Agustín Rossi re-filed the Executive's 2023 bill as expediente 3397-D-2026, after the original lost parliamentary status. According to a summary by the law firm Marval, the text was drafted by the AAIP. It would:
- add rights to portability, to object to some processing and to restrict processing;
- widen sensitive data to cover political opinions, gender identity, and genetic and biometric data;
- give people a right to human review of automated decisions with adverse or discriminatory effects;
- recognise legitimate interest as a legal basis, subject to a documented balancing test;
- require breach notification to the control authority within 72 hours;
- require data protection officers for public bodies and certain private organisations;
- apply to foreign entities that offer goods or services to, or monitor, people in Argentina.
That is recognisably the GDPR model. It is a sensible model in places. Legitimate interest with a balancing test is more flexible than a consent-only regime, and a 72-hour breach clock is by now an industry norm.
Where proportionality matters
The extraterritorial reach and the DPO mandate deserve the most scrutiny. Reaching foreign firms that merely offer services to people in Argentina can push small foreign developers and publishers to geoblock Argentine users rather than comply. The Marval summary does not describe the penalty regime, and that is exactly the detail that will determine whether the law is risk-based or punitive. We have not seen the full bill text, and this is the point lawmakers should settle before they vote. Adequacy decisions also carry a trade-off: the closer Argentina copies a foreign template to keep its status, the less room it has to tailor rules to local firms.
The AI and children priorities need the same discipline. Child-protection measures that rely on mandatory age verification create new stores of sensitive data and can wall minors off from lawful speech and information. A regulator that has just shown how much openness can improve public administration should be wary of rules that quietly shrink open access for young people.
The dual-mandate tension
The most interesting item at the anniversary was a panel on how access-to-information exceptions collide with personal data protection. According to the government's account of the event, panellists examined cases where access to information conflicts with fiscal secrecy, national security and personal data. Ley 27.275 itself builds this tension in. Article 8 lets an agency withhold information containing personal data that cannot be anonymised, unless disclosure would be lawful under Ley 25.326. In other words, the transparency law defers to the privacy law on exactly the cases where the two clash.
Having one body decide both sides has advantages: consistent interpretation and no turf war. The risk is that a single agency, under a statute that is now 26 years old, is the sole judge of when privacy overrides openness. Public-interest disclosure of officials' conduct and spending is a core free-speech value. A privacy exception that is stretched in the absence of clear statutory tests could erode the very transparency gains the AAIP is celebrating. A new data law should therefore define the public-interest balance explicitly, rather than leaving it to agency discretion.
What lawmakers should do
The AAIP's record on transparency is the best argument that it can run a competent regulator, and the best reason to give it clearer statutory limits. Congress should move the bill into committee, publish the penalty provisions for public comment, and build in a written public-interest test for disclosure disputes. It should also replace blanket mandates with proportionate ones, scaling DPO and impact-assessment duties to the risk and size of the processor. Finally, any child-safety provisions should be evidence-based and avoid forcing universal identity checks.
Argentina has shown that a decade of patient implementation can lift transparency. Doing the same for data protection means passing a law that is modern, but not maximal.