In January 2017, a group of senators presented before the Chilean Congress a bill that repeals the Chilean Data Protection Act, Law No. 19,628 on Protection of Private Life. Almost a month later, the president of the Republic of Chile also filed before Congress a bill that significantly amends the same legal text.

Because both bills aim to raise the legal protection of privacy in the country, the Senate agreed to merge them in one single bill of law, generating a consolidated bill. 

The following is a summary of the main aspects of the consolidated bill. 

Scope

The bill regulates the processing of personal data as performed by individuals and organizations, both public and private, that are not governed by a special law.

The application of the law excludes some scenarios, such as the processing of data performed by the media only in regards to the exercise of the freedom of press, and the processing performed by individuals in regards to their personal activity.

Key amendments

• It sets forth, for the first time, principles that shall govern the use of personal data and new rights for data subjects.

• It specifies the scope of the concept of personal data. Today, data is personal when it relates to information concerning an individual, whether identified or identifiable. The bill establishes that an identifiable individual is any person whose identity can be determined, directly or indirectly, by information combined with other data, in particular by an identifier, for example, an ID number.

• The concept and requisites for consent are regulated in greater detail, with the bill defining consent as a free, specific, unequivocal, and informed manifestation. The unequivocal manifestation must involve, “an act of assertion proving the clarity of the subject’s will”; surpassing the “in writing” requisite of the current law.

• It establishes a new basis of legality for the processing of personal data, apart from the sole consent of the data subject.

• It establishes a conceptual difference between data transmission (in which data is disclosed to a third party, without transferring the actual data source) on the one hand; and assignment of data, which requires the fulfillment of additional requisites and makes the assignee responsible for the data on the other.

• It further develops the concept of “sources of public access,” specifying that they shall be those which may be accessed or consulted in a lawful manner by anyone, without restrictions, or legal obstacles, to access or use them. Additionally, it establishes the sources of public access as a lawful basis for the processing of personal data different from the consent of the data subject. 

• It regulates sensitive data in greater detail by establishing new data, such as biometric data, and data regarding biological human profiles; and it provides for a new category of “special data” for the data of children; data used for historical, statistical, scientific purposes and others; and geo-referencing data.

• It restricts the automated processing of data, entitling data subjects to request that no decision that significantly and negatively affects them or produces adverse legal effects would be adopted exclusively on the grounds of the automated processing of that data, with certain exceptions.

• It creates a Personal Data Protection Agency with the authority to monitor and punish violations of the law with of fines of up to 5,000 UTM. (UTM is the acronym for the Spanish Unidad Ttributaria Mensual, or Monthly Tax Unit, a unit of account used in Chile for — as the name suggests — tax purposes, and calculated and published by the Chilean Central Bank. 5,000 UTM equals approximately USD 370,000)

• It creates a National Registry for Compliance and Penalties.

• It sets forth new procedures to prosecute liabilities.

• It regulates international data transfers.

• It regulates the duty to adopt safety measures and reporting obligations in regard to security breaches.

• It establishes the possibility for the data controller to adopt and certify a model for breach prevention, associated with mitigating circumstances regarding liability.

Principles

For the first time, it sets forth certain principles to which the interpretation of the law must abide: lawfulness, purpose, proportionality, quality, liability, security and information.

Data subject rights

The draft provides rights for data subjects including access, rectification, cancellation, opposition and portability.

Processing of personal data

General rule: Consent

Processing of personal data is legal — as a general rule — as long as the data subject grants their consent. 

Consent must be a free, informed and specific as to its purpose. Additionally, it has to be manifested in an unequivocal form and granted through an oral or written statement or granted through equivalent electronic means, or through an act of assertion that clearly evidences the data subject’s will.

Consent is revocable without expression of cause, but such act of revocation does not have retroactive effects.

However, the consent will not be considered as a sufficient legal basis for the validity for the processing of personal data when an “ostensible imbalance” between the position of the controller and the data subject exists.

New basis of legality for the processing of personal data

It shall not be necessary to obtain the data subject’s consent for the following processing of personal data, among others: 

• If data has been gathered from a source of public access;
• If processing of personal data refers to data related to economic, financial, banking or commercial obligations, and is performed according to the provisions of title III of the law (which regulates use of such data);
• If processing of personal data is necessary for the compliance of a legal obligation, or the execution of an agreement of which the data subject is party to. 

Obligations of the data controller

Among the obligations of the data controller, we underscore an enhanced confidentiality, a duty of information and transparency, a new duty of security (currently, data controllers only have a general duty of processing the data with due care), and a new duty to report security breaches to the authority and, in certain serious cases, to the data subjects.

Sensitive data and special categories of data

Sensitive data

Sensitive data may only be processed if the express consent of the data subject is granted through a written or verbal statement or an equivalent technological means.

Main exceptions to the obligation to obtain consent for the processing of sensitive data are: 

• If sensitive data has been made manifestly public by the data subject;
• If the processing of personal data is based on a legitimate interest performed by a nonprofit organization with a political, philosophical, religious, cultural, sports, union, or trade-related organizational objective, regarding its members or affiliates, in order to comply with its specific purposes; as long as the organization provides guarantees to avoid nonauthorized use and the data is not communicated or assigned to third parties.
• If the processing of personal data is essential to safeguard the life, health or integrity of the data subject.

The bill separately regulates the following types of sensitive data:

• Sensitive personal data related to health
• Biometric sensitive data
• Data related to the human biological profile

Special data

The bill categorizes and specifically regulates for the first time data related to children; data processed or gathered for historical, statistical, and scientific purposes, and for research studies or investigations; and geolocation data.

Personal Data Protection Agency

A Personal Data Protection Agency is created as a public, technical, decentralized entity, with a legal nature and its own capital, aimed at ensuring compliance with rules on personal data processing, and subject to the monitoring of the President of the Republic via the Department of the Treasury. 

The APDP will be an entity with ample powers, which include:

• Issuing general and mandatory instructions
• Overseeing compliance with the law on personal data and its regulations
• Settling claims filed by data subjects
• Working for disclosure and promotion of information to citizens
• Managing the National Registry of Compliance and Penalties

International transfer of personal data

For the first time, the bill regulates international transfers of personal data specifying the situations where they are lawful, for example:

• Whenever it is performed to a person, entity or organization that is subject to a country’s legal order which provides an adequate level of data protection.
• Whenever it is safeguarded by contractual clauses or other legal instruments signed between the controller who transfers personal data and the one who receives it. 
• Whenever the data subject grants their written consent in order to perform a specific international data transfer.

Infringements and penalties

The bill classifies infringements as minor, serious and gross, and determines penalties of fines ranging from 1 to 5,000 UTM (between approximately USD 74 to USD 374,000 as of October 2017).

Whether or not this bill will pass and become a law, or when will that happen, is uncertain. This is the third major effort that a Chilean government has made in order to modify a very outdated data protection framework, which lacks a data protection authority and that has been criticized for its lack of effectivity by almost all stakeholders. 

photo credit: Psicoground The most beautiful flag! via photopin (license)