On August 26, 2024, the Chamber of Deputies announced that the Chilean House of Representatives approved Bill No. 11144-07 Regulating the protection and processing of personal data and creating the Personal Data Protection Agency and Bill No. 11092-07 on the protection of personal data. The proposal will be provided to the Executive for publication and passage into law. The Chamber of Deputies stated that the law will determine duties and obligations for data controllers, and regulate the processing of various types of data, including sensitive data, biometric data, and children's data.

Scope of the act

The Chamber of Deputies stated that the law seeks to ensure that processing is carried out with the consent of the data subject or where authorized by law, in addition to ensuring quality, information, transparency, and security standards. The Chamber of Deputies also stated that all processing of personal data that is carried out by a natural or legal person, including public bodies, must respect the rights and freedoms of individuals, and will be subject to the final provisions outlined within the law.

The Chamber of Deputies highlighted that the law, once passed, will not apply to the processing of data carried out in the exercise of freedom to express opinions, to inform, or to the use of background information by natural persons as it relates to their personal activities.

Activities within the scope of the law, once passed, will include:

• parties or agents established within Chile;
• agents carrying out operations on behalf of a party or agent established or incorporated in Chile;
• when an agent is not established in Chile, but conducts operations to offer goods or services within Chile; or
• activities carried out by a controller who, even though not established in the national, is subject to national legislation due to a contract or international law.

The Chamber of Deputies also mentions that the law requires data to be:

• processed lawfully and fairly;
• only be collected for specific, explicit, and lawful purposes; and
• strictly limited to purposes necessary, adequate, and relevant to the purposes of the processing.

Personal Data Protection Agency

The Chamber of Deputies highlighted that the creation of the Personal Data Protection Agency (the Agency) is included in the law. The Agency's purpose will be to ensure the effective protection of the rights that guarantee privacy to individuals and also oversee compliance with its provisions.

You can read the press release here and track the progress of Bill No. 11144-07 here and Bill No. 11092-07 here, all only available in Spanish.