Background

Given the urgent discussion notice on the Bill and some recent developments, such as the incorporation of the right to data protection in the Political Constitution of the Republic of Chile in 2018, the reform of Law No. 19.496 which Establishes Rules on the Protection of Consumer Rights ('the Consumer Protection Law') that granted the National Consumer Service ('SERNAC') certain faculties regarding consumers' data privacy, and a statement given by Chile's new Minister Secretary General of the Presidency, it is expected that the Bill will be enacted as law during this year, without prejudice to a statutory vacancy period of 25 months.

Key provisions of the Bill

Some of the most relevant aspects of the Bill relate to the following:

• New legal bases for data processing, such as the execution of a contract or of pre-contractual measures, or the legitimate interest of the data controller or a third party, provided that such processing does not affect the rights and freedoms of the data subject and if it is required by law, are incorporated into the Bill. In the current legal landscape, the data subject's consent is the main basis for data processing; however, broad exceptions are expressly stated by the Data Protection Law, such as the processing for direct marketing purposes and the processing of data obtained from publicly available sources.
• When the data processing is based on the data subject's consent, it is stated that said consent must be free, informed, and specific regarding its purposes, and be expressed unequivocally.
• The special categories of biometric, georeferencing, health-related, and biological data, among others, are introduced. The Bill also dedicates an Article to the processing of children's personal data.
• On a similar note, new bases for the processing of sensitive data are incorporated in addition to the data subject's consent.
• The principles of lawfulness, purpose, proportionality, minimisation, quality, accountability, security, transparency, and confidentiality are expressly recognised by the Bill.
• The Bill introduces a chapter on international data transfers, a subject not currently regulated by Chilean law. This chapter states that personal data can be transferred to entities in countries that provided an adequate level of data protection, when the transfer is subjected to appropriate legal safeguards or binding corporate rules ('BCRs'), and with the data subject's consent, among others. The Bill also proposes a rule to determine when a country offers an adequate level of data protection.
• New obligations for data controllers are established, such as the duty of security and to report data breaches.
• The Bill also distinguishes between personal data transfers and assignments, establishing legal requirements for said operations.
• The Bill grants new rights for data subjects, such as the right to data portability and to object to automated personal assessments.
• The figure of the data protection officer ('DPO') is introduced.
• An Agency for the Protection of Personal Data as the data protection authority ('the Agency') is created.

Introduction of a data protection authority

The creation of the Agency is probably one of the most anticipated reforms, since as of today, Chile does not have a specialised authority for data privacy matters, said functions mainly pertaining to courts and, recently introduced, to the SERNAC.

In accordance with the creation of the Agency, new administrative procedures for the enforcement of the new data privacy landscape are created, as well as new penalties and sanctions, including the suspension of operations and data processing activities to the data controller by a certain period of time. This significantly changes the current scenario, since one of the most criticised aspects of the current law is that the lack of strong sanctions for its violations and the fact that any claims must be presented before ordinary courts, hinders the data subjects' possibilities to effectively enforce their rights.

The Bill also incorporates a new National Registry for Compliance and Penalties, and enables data processors to qualify for data privacy compliance certifications.

Conclusion: Challenges going forward

As stated above, the Bill encompasses many of the current trends in data privacy, creating a more suitable legal framework regarding the subject; however, if the Bill is enacted, some conflict between the newly created Agency and the SERNAC is foreseeable, given the latter's attributions regarding consumers' personal data.

Finally, it must be stated that Chile is currently in the process of drafting a new Constitution, which is expected to be voted on in the following months and could eventually radically affect the future of the Bill and the general principles within it.

Rodrigo León Lawyer
[email protected]
Gabriella Burgos Herrera Lawyer
[email protected]
SILVA, Santiago