CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
The duty to notify data subjects In addition to notifying the regulator, the controller must communicate the breach directly to the affected individuals in specific high-risk scenarios. This notifi - cation is mandatory when the breach involves: • sensitive personal data (such as health or biometric data); • data relating to minors (children and adolescents); or • data regarding economic, financial, banking, or commercial obligations. This communication must use clear and simple lan - guage, detailing the specific data affected, the poten - tial consequences, and the safeguard measures adopted. If individual notification is not feasible, the controller must publish a notice in mass media with national reach. Necessary Action Items for Organisations • Detection and Internal Recording: The organisation must immediately log the incident. The New Law requires the maintenance of a register of breaches, documenting the nature of the event, its effects, and the categories of data affected. This internal record is essential for demonstrating compliance to the Agency during future audits. • Mitigation and Containment: Controllers must deploy immediate technical and organisational measures to reduce the impact of the breach. For entities classified as Operators of vital importance under the Cybersecurity Framework Law, specific regulations mandate actions such as restricting access to compromised systems, isolating affected networks, and changing administrative passwords within three hours of detection. • Risk Assessment: The Data Protection Officer (DPO) or the security team must evaluate whether the breach poses a “reasonable risk” to the rights and freedoms of individuals to determine if notifica - tion to the Agency is required. • Management of Data Processors: If the breach originated from a third-party service provider (data processor), the provider has a statutory obligation to report the incident to the controller. Organisa - tions must ensure their contracts explicitly man -
Impact on Transparency, Governance and Oversight • Transparency and Information: The New Law mandates a duty of active transparency. Control - lers engaging in ADM or profiling must provide the data subject with “significant information” about the logic applied, as well as the significance and the envisaged consequences of such processing for the individual. • Data Governance: The pending AI bill proposes establishing a principle of data governance, translating into specific obligations for operators of high-risk AI systems regarding information man - agement. Furthermore, the public sector guidelines emphasise interoperability and preventing the mis - use of data in generative AI tools not under direct state control. • Human Oversight: The requirement for “human intervention” is a statutory right under the New Law for any ADM process. 1.6 Data Breach Requirement Requirements Applicable in Case of a Data Breach Under the new regulatory landscape established by the New Law, the management of security incidents has shifted from a reactive, unregulated approach to a proactive, mandatory reporting regime. The duty to report to the Agency The New Law introduces a statutory obligation for data controllers to report security breaches to the Agency. This duty arises when a breach of security measures results in the destruction, leakage, loss, or accidental or unlawful alteration of personal data, or unauthorised access to such data. • Trigger: The obligation applies specifically when the breach poses a reasonable risk to the rights and freedoms of the data subjects. • Timing: The report must be made through the most expeditious means possible and without undue delay. • Content: The notification must describe the nature of the breach, the effects, the approximate number of affected data subjects, and the remedial meas - ures taken.
38 CHAMBERS.COM
Powered by FlippingBook