CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
Public Sector The Council for Transparency is responsible for ensur - ing compliance with the Law by the organs of state administration. The Council has issued the Recom - mendations on Protection of Personal Data by the Organs of the State Administration, the Guide on Pro - tection of Personal Data for Public Institutions (2021). Financial Sector The Financial Market Commission (CMF) is the control body in the financial sector and has regulatory and supervisory powers in matters of personal data pro - tection, information security and cybersecurity. Under Chapters 18-5, on information about debtors from financial institutions, and Chapters 20-6 and fol - lowing the Updated Compilation of Standards (RAN) of the CMF on business continuity, information secu - rity and outsourcing of services, financial institutions must have an internal policy on security and man - agement of debtor information (PISMID), which must follow international principles and best practices on personal data processing. Law No 21.521, known as the “Fintech Law”, to “[pro - mote] competition and financial inclusion through innovation and technology in the provision of financial services”, mandates the CMF to dictate the cyber - security and personal data protection standards that financial institutions participating in the future Open Finance System must comply with. Cybersecurity In the area of cybersecurity, Chile has the Cyberse - curity Framework Law No 21.663, which created the National Cybersecurity Agency. In terms of personal data protection, the Cybersecurity Framework Law considers the obligation of essential service providers and operators of vital importance to report cyberse - curity incidents with significant effects to the National CSIRT, including incidents affecting computer sys - tems containing sensitive personal data. 1.8 Enforcement Proceedings and Fines There is currently no privacy regulator or data protec - tion authority in Chile. Data protection enforcement is addressed by general courts with general powers. A summary court procedure is established by the Law
date this reporting to allow the controller to meet its own regulatory deadlines. Mass Data Privacy Litigation The breach of the duty to report or the failure to imple - ment adequate security measures can trigger signifi - cant civil liability. The New Law expressly establishes that the controller must indemnify both patrimonial and non-patrimonial (moral) damages caused to data subjects. • Class Actions: While individual lawsuits are pos - sible, the most significant risk lies in collective redress mechanisms. SERNAC or consumer asso - ciations can file class actions ( demandas colecti- vas ) representing the collective interest of consum - ers affected by a mass data breach. • Compensation: The law allows for the indemnifica - tion of damages once the administrative sanction is final. Please note that privacy litigation is dealt with in great - er detail in 2. Privacy Litigation . 1.7 Regulators At present, and in general, the main regulators of data protection are the civil courts under the Law. How - ever, this will change in 2026 when the Personal Data Protection Agency created by the New Law begins operating. For its part, currently other entities have powers in matters of personal data protection, the main ones Currently, the National Consumer Service (SERNAC) is the supervisory body for the protection of personal data in the context of consumer relations, until the Personal Data Protection Agency is established in 2026. Although it does not have sanctioning powers, SER - NAC can exercise its powers to file individual or class actions before the courts, supervise, inspect, investi - gate, and issue interpretative circulars that are man - datory for SERNAC officials when applying the regula - tion and the Law (eg, at the time of audit). being the following. Consumer Rights
39 CHAMBERS.COM
Powered by FlippingBook