Brighter Stars and Persistent Gaps Mark New Paraguay’s “Who Defends Your Data” Report

Paraguay’s leading broadband service providers last year upped their commitments to users to be transparent about their privacy policies and to adopt accessibility practices, but most fell short on disclosing information about government requests seeking their data, according to the new edition of TEDIC’s ¿Quién Defiende Tus Datos? (“Who Defends Your Data).

The report reveals a troubling trend among Paraguayan internet and telecommunications providers: most don’t publish reports with statistical data on such requests or disclose procedures they follow when handing user’s data to authorities. What’s more, companies still resist  making a public commitment to notify users about government data demands. Although this is usually a difficult  commitment to get from companies evaluated in the region, we see some strides in Chile, Colombia, and Argentina. In Paraguay’s report, however, all service providers failed in this category.

This undermines users’ ability to make informed choices about which companies they should entrust their data to. Our reliance on internet connection providers to browse, access information online, and communicate with others puts vast amounts of highly sensitive data into the hands of service providers. TEDIC’s report shows they must address this weakness by giving users more information about how these requests are handled and revealing to what extent they have users’ back when the government demands their data.

The new report looked at publicly available documents and policies of five companies: Tigo (Millicom), Claro (América Móvil), Personal, Copaco, and Vox. All have been assessed by TEDIC since the report’s first edition in 2017. Since then, Claro showed notable advances in  the privacy policy and transparency report categories. Tigo has also improved its privacy and data protection policies’ marks over the years. In this 2022 edition, Tigo kept its leadership position while Claro stayed firm in second place. Copaco, which didn’t receive any score in the last edition, shared third place with Personal this year. Finally, Vox lagged  far behind, getting only a minimum score in one of the evaluated categories. 

Paraguay’s full study is available in Spanish. 

Regarding privacy and data protection policies, TEDIC’s study checked whether companies provided clear and easily accessible information about personal data collection, processing, and sharing with third parties, as well as retention times and security practices. All companies but Vox scored for publishing their privacy and data protection policies and earned at least partial stars for accessibility features on their websites. Both Claro and Tigo received a full star. Personal and Copaco earned only a quarter star, as their policies are generic and don’t contain relevant details on what personal information is collected and stored, for how long, and how third parties and authorities can have access to and use customers’ data.

Unlike other countries in Latin America, Paraguay still doesn’t have a comprehensive data protection law in force. TEDIC and allies have been working to push forward legislation that can fulfill this gap and ensure robust data protection principles and safeguards for  all Paraguayans. Yet, companies don’t have to wait for the bill to be approved to increase transparency about how they process their users’ personal information. In fact, the broadband providers in the report should have already taken that on.

Paraguay’s report also analyzed whether companies publish transparency reports with information about government requests for users’ data, and whether such reports provide additional detail on types of data requested, requesting authorities, and justification for the request. Only Tigo and Claro scored in this category, earning half-stars for reports published by their parent companies—Millicom and América Móvil</&