CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
Magliona Abogados Santiago de Chile Avda Andrés Bello 2687 Piso 24, Las Condes Santiago de Chile Santiago Chile Tel: +56 2 3210 0030 Fax: +56 2 377 9451 Email: contacto@magliona.cl Web: www.magliona.cl
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Overview of Data and Privacy-Related Laws The Chilean legal framework for data protection is anchored in Article 19, No 4 of the Political Constitu - tion of the Republic of Chile, which guarantees the protection of personal data. This constitutional provi - sion ensures that the processing and protection of personal data must be carried out in the manner and under the conditions established by law. Additionally, Chile has a specific statute, Law No 19.628 on Privacy Protection (the “Law”), published on 28 August 1999. While the current version of the Law was not originally based on international instruments such as the GDPR, a significant reform has recently been enacted. On 13 December 2024, Law No 21.719 on Personal Data Protection (the “New Law”) was published in the Official Gazette, reforming and updating Law No 19.628. This regulation introduces substantial modifi - cations and raises standards for data controllers and processors, drawing inspiration from the European Union’s General Data Protection Regulation (GDPR). The New Law establishes a 24-month vacancy period, meaning it will enter into full force on 1 December 2026. During this transition, entities must adapt their processing activities before the new Personal Data Protection Agency (the “Agency”) begins its functions and enforcement powers.
Sectoral Instruments and Interactions Across Levels of Law Currently, the interaction between legal sources relies heavily on general statutes and sectoral oversight, as there is no centralised data protection authority until the Agency is established in 2026. The interplay between these sources operates as follows: • Consumer Protection: The National Consumer Service (SERNAC) acts as the supervisory body for data protection within consumer relations. SERNAC exercises powers to file class actions, inspect, and issue interpretative circulars, filling the gap until the Agency becomes operational. • Public Sector: The Council for Transparency over - sees compliance by state administration bodies. It issues recommendations and manages procedures for access rights (ARCO rights) within the public sector, ensuring co-ordination with the Transpar - ency Law (Law No 20.285). • Financial Sector: The Financial Market Commission (CMF) regulates the financial sector, including data protection and cybersecurity. Under the Fintech Law (Law No 21.521), the CMF is mandated to dictate standards for the Open Finance System. Furthermore, the CMF’s Updated Compilation of Standards (RAN) imposes specific obligations on financial institutions regarding data security and outsourcing.
32 CHAMBERS.COM
Powered by FlippingBook