CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
Extraterritorial Reach Under the New Law (Law No 21.719), the scope of application extends beyond national borders based on specific triggers designed to protect data subjects located in Chile. The law applies to the processing of personal data when the controller or processor is established in the national territory. Furthermore, strictly extraterritorial application is triggered in the following scenarios: • when a processor, regardless of their location, performs data processing operations on behalf of a controller established or constituted in Chile; • when the controller or processor is not established in Chile, but their processing operations are intend - ed to offer goods or services to data subjects located in Chile, regardless of whether payment is required; • when the processing involves monitoring the behaviour of data subjects located in Chile, includ - ing analysing, tracking, profiling, or predicting their behaviour; or • when a controller not established in Chile is subject to national legislation due to a contract or interna - tional law. Responsible parties not domiciled in Chile who process data of residents must designate an email address or suitable contact method to receive com - munications from data subjects and the Agency. Interplay with Non-Personal Data, Cyber, and AI Cybersecurity and critical infrastructure Chile recently enacted the Cybersecurity Framework Law No 21.663, which created the National Cyberse - curity Agency (ANCI). This law interacts with data pro - tection statutes by mandating the reporting of cyber - security incidents that may affect personal data. The law establishes the principle of “security and privacy by default and by design”, requiring systems to be designed with data protection in mind. Specific interplay includes: • Incident Reporting: Institutions must report inci - dents with significant effects to the National CSIRT. If an incident affects systems containing personal data, it is considered to have a “significant effect”.
• Data Protection in Reporting: Reports of cyber inci - dents must generally omit personal data to protect privacy, unless essential for management, and IP addresses are explicitly excluded from the defini - tion of personal data for these specific reporting purposes. Artificial intelligence (AI) The regulation of AI in Chile is evolving and intersects directly with data privacy rules. The National AI Policy 2024-2031 promotes ethical and responsible AI use. • Current Guidance: Guidelines for state agencies recommend that processing personal data for AI training or development must strictly comply with Law No 19.628, ensuring data is used only for authorised purposes. It is advised not to enter sensitive personal data into generative AI tools not contracted by the state. • Legislative Proposals: A bill regulating AI systems is under discussion, inspired by the EU AI Act. This bill proposes a risk-based approach and establish - es that the new Personal Data Protection Agency will act as the supervisory authority for AI matters, while a Technical Advisory Council and the Ministry of Science will handle regulatory powers. • Automated Decisions: The New Law introduces the right for data subjects not to be subject to decisions based solely on automated processing, including profiling, that produce legal or significant effects. 1.2 Rights and Obligations General Principles and Requirements for Processing The Chilean legal framework regarding personal data is currently undergoing a significant transition follow - ing the publication of Law No 21.719 (the “New Law”) on 13 December 2024, which updates Law No 19.628. This regulation introduces a comprehensive catalogue of principles that align Chile with international stand -
ards, particularly the GDPR. Principles of Data Processing
Under Article 3 of the New Law, any processing of personal data must strictly adhere to the following principles:
33 CHAMBERS.COM
Powered by FlippingBook