CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
cybersecurity, requiring public bodies to implement processes that safeguard confidentiality, integrity, and availability of information (both personal and non-personal) on their electronic platforms. There are other regulations establishing rules for interop - erability, authentication, etc. Cybersecurity and Critical Infrastructure The protection of non-personal data is addressed through the lens of cybersecurity and critical infra - structure protection. Cybersecurity Framework Law (Law No 21.663) This law, which entered into force in 2024, applies to both public and private entities providing “essential services” (eg, energy, telecommunications, finance, digital infrastructure). • Scope: The law protects the resilience of networks and computer systems. It mandates the reporting of incidents that could have “significant effects” on the continuity of essential services, regardless of whether personal data is compromised. • Regulated Actors: The National Cybersecurity Agency (ANCI) regulates “Operators of Vital Impor - tance” (OIV). These operators must implement security management systems to protect their information assets and ensure business continuity. • Cloud and Digital Infrastructure: The ANCI has identified critical digital functions, including data hosting, cloud administration (IaaS, PaaS, SaaS), and data processing services, as falling within the scope of the law due to their importance for national digital infrastructure. Sectoral Guidance: Financial Services and Cloud Computing Financial Market Commission (CMF) Rules The CMF issues binding instructions, such as Chapter 20-7 of the Updated Compilation of Standards (RAN) and General Norms. • Cloud Outsourcing: Financial entities outsourcing data processing to cloud providers must ensure the provider maintains adequate security mecha - nisms (physical and logical) to isolate the entity’s infrastructure from other clients.
• Data Integrity and Availability: The regulations require measures to prevent information leaks or events affecting the availability, confidentiality, and integrity of the entity’s data. • Encryption: Entities must use encryption tech - niques for data stored in the cloud, appropriate to the nature and sensitivity of the information. National Data Centres Plan To foster the non-personal data economy, the Ministry of Science launched the National Data Centres Plan 2024-2030. This policy aims to promote the growth of the local data centre industry, strengthen connec - tivity (eg, Humboldt submarine cable), and simplify the permitting process for digital infrastructure pro - jects, thereby facilitating the processing capabilities required for AI and cloud computing. 3.2 Interaction of Data Regulation and Data Protection Legal Basis and Lawfulness of Processing The interaction between data regulation frameworks and privacy rules in Chile is fundamentally governed by the principle of lawfulness established in the new Personal Data Protection Law (Law No 21.719). Under this regime, the processing of personal data is only legitimate when founded on specific legal bases, such as the consent of the data subject, the execution of a contract, compliance with a legal obligation, or the satisfaction of legitimate interests. The Cybersecurity Framework Law (Law No 21,663) explicitly states that any data processing carried out for cybersecurity pur - poses must strictly comply with Law No 19,628 (and its successor, Law No 21.719), particularly regarding Confidentiality is a transversal obligation across Chil - ean digital regulations. The Personal Data Protection Law imposes a duty of secrecy and confidentiality on data controllers and processors, a duty that persists even after the relationship with the data subject has ended. In the public sector, officials dealing with sen - sitive data or infraction records are subject to strict secrecy obligations, where violations are considered grave breaches of administrative probity. Similarly, the Fintech Law (Law No 21.521) mandates that financial information service providers must maintain confiden - the principle of purpose limitation. Confidentiality of Personal Data
42 CHAMBERS.COM
Powered by FlippingBook