The Official Gazette published the Cybersecurity and Information Security Law and the Personal Data Protection Law, which are now in effect in El Salvador following their approval on November 12 by President Nayib Bukele. Despite requests from civil society organizations for both laws to be reviewed and debated more thoroughly, Bukele signed them into law without objections.
The new legislation establishes the creation of the State Cybersecurity Agency, which will be responsible for overseeing compliance with these regulations. A few days ago, several civil organizations expressed concern in a statement, stating that the ACE could have "almost unlimited power." They urged the president to veto the laws, arguing that they violate fundamental rights such as freedom of expression and the press.
The organizations also criticized the laws for imposing the obligation to delete personal data, which could make it easier for powerful officials to request media outlets to remove information about individuals involved in corruption. Furthermore, they warned that the ACE, under the control of the Executive branch, could act arbitrarily in deciding what information is deemed inaccurate or incomplete, which could severely impact access to the truth.