CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
• Implement an Infringement Prevention Model: It is highly advisable to adopt an Infringement Preven - tion Model (Compliance Programme) that can then be certified by the Agency, which will reduce the amount of penalties for possible infringements. This model must include the appointment of a data protection officer (DPO) who will act as a point of contact between the authority and the interested parties. The DPO must have sufficient resources and independence to perform their duties effec - tively. • Update Policies and Contracts: Privacy policies must be updated to meet the new transparency requirements, clearly explaining rights and legal bases to data subjects. Furthermore, all contracts with third-party service providers (data processors) must be reviewed and updated to include spe - cific mandatory clauses regarding confidentiality, security, and the prohibition of using data for other purposes. • Risk Management and Security Measures: Organi - sations must implement technical and organisa - tional security measures appropriate to the risk, such as encryption or pseudonymisation. For processing activities that pose a high risk to data subjects’ rights, performing a Data Protection Impact Assessment (DPIA) is mandatory prior to processing. • Establish Incident Response Procedures: Proce - dures must be established to detect, manage, and report security breaches. The New Law imposes a duty to report security breaches to the Data Pro - tection Agency and, in certain cases involving high risk, to the affected data subjects. • Manage International Transfers: If the organisation transfers data outside of Chile, it must ensure the destination country offers adequate protection or implement appropriate guarantees, such as stand - ard contractual clauses approved by the Agency. Without these guarantees, international transfers may constitute a serious infringement. 1.3 Special Categories of Personal Data Based on Law No 21.719 (the “New Law”), which modifies Law No 19.628, the Chilean legal framework establishes a reinforced protection regime for specific categories of data. These rules impose stricter obliga -
tions on data controllers compared to the processing of standard personal data. Sensitive Data The New Law defines sensitive data as information referring to the physical or moral characteristics of individuals, or facts regarding their private life or inti - macy. This includes data revealing ethnic or racial origin, political affiliation, union membership, socio - economic situation, ideological or philosophical con - victions, religious beliefs, health, biological profiles, biometrics, and information regarding sexual life, ori - The processing of sensitive data is generally prohib - ited unless the data subject provides their express consent. This consent must be given through a written declaration, verbally, or via an equivalent technologi - cal medium. Exceptions to consent entation, or gender identity. General rule for processing The legislation provides specific legal bases where sensitive data may be processed without consent, provided it is done lawfully: • Publicly Available Data: Sensitive data may be pro - cessed without consent when the data subject has made the data manifestly public, and the process - ing aligns with the purpose of that publication. • Non-Profit Associations: Foundations, NGOs, or associations with political, philosophical, religious, or trade union aims may process data of their members. This is permissible provided the pro - cessing relates solely to their members, guarantees are in place to prevent leaks, and the data is not transferred to third parties. • Vital Interests: Sensitive data may be processed without consent when necessary to safeguard the life or physical/psychic integrity of the holder or another person, particularly if the data subject is physically or legally unable to consent. • Legal Defence: Sensitive data may be processed without consent when necessary for the formula - tion, exercise, or defence of a right before courts or administrative bodies.
35 CHAMBERS.COM
Powered by FlippingBook