CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
1.4 Processing of Personal Data for Research and Development Purposes Anonymisation of Patient Data for Research and Development Under the Chilean legal framework, particularly fol - lowing the enactment of Law No 21.719 (the “New Law”) which updates Law No 19.628, the processing of health data is subject to a reinforced protection regime. However, specific provisions allow for the use and anonymisation of such data for scientific and product development purposes under strict condi - tions. Exceptions for Scientific Research and Product Development While the general rule for processing sensitive data (such as health data) is the requirement of express consent from the data subject, the legislation intro - duces specific exceptions relevant to life sciences companies: • Public Interest and Human Health Benefit: Pro - cessing health and biological profile data without consent is permitted when used for historical, statistical, or scientific purposes. This specifically includes studies or investigations that serve the public interest or benefit human health, as well as the development of medical products or inputs that could not be developed otherwise. • Legitimate Interest in Research: The law establish - es a presumption of legitimate interest for process - ing performed exclusively for historical, statistical, or scientific purposes, provided they serve the public interest. • Requirement to Anonymise for Publication: While the processing for the research itself may involve personal data under strict security measures, the New Law mandates that any publication or dif - fusion of the results and analyses obtained from such studies must be preceded by the anonymisa - tion of the data. Mandatory Data Protection Impact Assessments (DPIAs) Life sciences companies will likely be required to con - duct a DPIA prior to commencing processing. The New Law mandates this assessment when process - ing is likely to result in a high risk to data subjects’
Health, Biological, and Biometric Data The regulation creates a sub-category for health and biological data (such as genetic or metabolic profiles), which generally follows the rules for sensitive data but includes specific sanitary exceptions. These may be processed without consent for reasons of public health interest (such as sanitary alerts), medical diag - nosis, provision of healthcare services, or scientific research, provided the data is anonymised prior to any publication of results. Regarding biometric data (fingerprints, iris scans, voice, facial features), the controller must comply with heightened transparency duties. Before processing, the controller is obliged to inform the data subject about the specific identification system used, the pre - cise purpose, the duration of the use, and the method for exercising data subject rights. Data Relating to Minors (Children and Adolescents) The New Law introduces a regime based on the prin - ciple of the best interest of the child and progressive autonomy. It distinguishes between “children” (under 14 years old) and “adolescents” (14 to under 18 years old). • Children (Under 14): Processing requires the express consent of their parents, legal representa - tives, or those holding personal care. There is no scenario where a child under 14 can validly con - sent on their own. • Adolescents (14 to 17): Generally, adolescents may provide consent for the processing of their data autonomously. However, if the data is classified as sensitive, adolescents under the age of 16 still require the consent of their parents or legal guard - ians. Educational establishments and other entities pro - cessing data of minors have a specific statutory obli - gation to ensure the lawful use and protection of this information.
36 CHAMBERS.COM
Powered by FlippingBook