CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
rights, explicitly listing the processing of sensitive data (health data) as a trigger for this obligation. 1.5 Processing of Personal Data in the Context of Artificial Intelligence The intersection of artificial intelligence (AI) and data privacy in Chile is currently governed by the recent - ly enacted Law No 21.719 (the “New Law”), which updates Law No 19.628, and a series of sectoral guidelines. While a specific bill regulating AI systems is under discussion in Congress, the New Law estab - lishes the binding framework for processing personal data within AI models. General Requirements and Specific Guidance The use of personal data in AI systems must adhere to the general principles of the New Law, such as pur - pose limitation, proportionality, and security. There are specific requirements regarding automated decision- making and profiling, which are now formally regu - lated. In terms of guidance, distinct bodies have issued soft law instruments: • Public Sector: The Ministry of Science and the Digital Government Division issued a Circular Let - ter with “Recommended Guidelines for the Use of AI by State Agencies”. It explicitly advises against entering sensitive personal data into generative AI tools unless they have been contracted or devel - oped specifically for the agency with appropriate safeguards. • Consumer Protection: The National Consumer Service (SERNAC) issued an interpretative circular regarding AI in consumer relations. It establishes that companies must ensure transparency, avoid arbitrary discrimination, and strictly protect con - sumers’ personal data when deploying AI systems. Rules Governing Automated Decision-Making The New Law introduces a specific regime for auto - mated decision-making (ADM), granting data subjects significant control over how AI affects them. Right to opposition and explanation Data subjects have the right not to be subject to deci - sions based solely on the automated processing of
their personal data, including profiling, if those deci - sions produce legal effects or significantly affect them. Exceptions and safeguards ADM is permissible only under three specific circum - stances: • it is necessary for the conclusion or execution of a contract; • it is authorised by law (with specific safeguards); or • the data subject has granted their express consent. Even when these exceptions apply, the controller must implement suitable measures to safeguard the data subject’s rights. These include the right to obtain human intervention, to express their point of view, to receive an explanation of the decision, and to chal - lenge it. Risk-Based Regime and High-Risk Categories The Chilean framework is increasingly shifting towards a risk-based approach, both under the data protection Under the New Law, the regime is risk-based. Control - lers must conduct a Data Protection Impact Assess - ment (DPIA) prior to processing if the activity is likely to result in a high risk to the rights of data subjects. The law explicitly categorises the following AI-related activities as mandatory cases for a DPIA: • systematic and exhaustive evaluation of personal aspects based on automated processing, including profiling, that produces legal or significant effects; and • massive data processing or processing on a large scale. Proposed AI regulation A bill regulating AI systems, currently before the Sen - ate, proposes a risk classification system inspired by the EU AI Act. It categorises AI systems into unac - ceptable (prohibited) risk, high risk, limited risk, and no evident risk. regime and the proposed AI legislation. Mandatory Impact Assessments for AI
37 CHAMBERS.COM
Powered by FlippingBook