CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
tiality and implement security measures to prevent unauthorised access or disclosure. Intellectual Property and Non-Personal Data Regarding non-personal data and intellectual prop - erty (IP), the regulatory framework seeks to balance transparency with the protection of proprietary assets. The Cybersecurity Framework Law obliges service providers to share information on vulnerabilities and incidents to prevent cyber threats; however, con - tracts regarding these services cannot restrict this communication unless it compromises IP protection. Furthermore, legislation on open finance and algorith - mic transparency protects the “business secrets” and proprietary logic of algorithms while requiring suffi - cient information to be provided to the data subject regarding the consequences of automated decisions. 3.3 Rights and Obligations Under Applicable Data Regulation Interoperability and Data Sharing Conditions Obligations regarding data sharing and interoperabil - ity are particularly strong in the public sector and the fintech ecosystem. The State Digital Transformation Law (Law No 21,180) and the new Data Protection Law mandate state bodies to achieve high levels of interoperability to prevent duplicating requirements for citizens. For private entities, specifically within the Open Finance System, participants must implement Application Programming Interfaces (APIs) that ensure secure and standardised data exchange. These exchanges require express, informed, and specific consent from the client, which can be revoked at any time. 3.4 Regulators and Enforcement Competent Authorities The enforcement landscape in Chile is transitioning towards a model with specialised technical authori - ties. The Personal Data Protection Agency, created by Law No 21.719, is the independent corporation responsible for supervising compliance, interpreting regulations, and sanctioning infringements regarding personal data. In parallel, the National Cybersecurity Agency (ANCI) enforces the Cybersecurity Framework Law, supervis - ing essential service providers and critical infrastruc -
ture. For the financial sector, the Financial Market Commission (CMF) retains jurisdiction over fintechs and banks, enforcing operational resilience and data protection standards specific to that industry. Role of the Digital Government Secretariat Regarding the public sector, the Digital Government Secretariat, which operates under the Ministry of Finance, plays a pivotal role. This entity serves as the intersectoral co-ordinator for the strategic use of digital technologies and data within the State Admin - istration. It is empowered to issue circulars, technical guidelines, and directives to support public bodies in implementing data protection and information security standards. Under both the current law and the New Law that will come into force in December 2026, if cookies collect personal data, they can be considered data process - ing, so companies that place cookies will require the consent of the data subject (with some exceptions or using other bases of lawfulness of data processing) and comply with the general rules for the processing of personal data. 4.2 Personalised Advertising and Other Online Marketing Practices Law No 19,496 on the Protection of Consumer Rights contains a provision regarding marketing through email. Every promotional or advertising communica - tion sent by email must indicate its subject, the iden - tification of the sender and a valid email address to which the recipient can address their request for the suspension of the advertising communication, which will remain banned from then on. Providers that direct promotional or marketing com - munications to consumers via mail, fax, telephone calls or messaging services must indicate an expe - dited way the addressees may request the suspension of the communications. 4. Sectoral Topics 4.1 Use of Cookies
43 CHAMBERS.COM
Powered by FlippingBook