Personal data in Chile: everything you need to know
A bit of context
Some people say that personal data protection has never been regulated in the Chilean legal system. The reality is that the rules are out of date, and that they sit scattered across different bodies, terminologies and specialties. That keeps the legislation from being fully coherent.
There are two main reasons for this: political will and, the more interesting one, technological development. Information technology has moved so fast and so dynamically that many countries have had to adapt their rules to keep up with the new reality.
In this hyperconnected world, large organizations have mostly been regulated by the rules of first-world countries and by the international standards that make it possible to do business with them. Take a company with foreign capital that holds or transfers data on people in the European Union: it must comply with the GDPR (the European General Data Protection Regulation), no matter where it is located or what the local rules say.
Chile was a pioneer here: in 1999 it published Law No. 19.628, On the protection of private life and personal data. Given that the first internet connection —nothing like the reach it has today— dates from 1993, the law was an innovation for its time.
The law's name, “On the protection of private life and data”, reveals an interesting detail about the regulation and its goals. Before data, what worried lawmakers was the possible harm to a right classified as a human right. “Private life”.
Historically there have been many definitions of what “privacy” means. It helps to separate the Anglo-Saxon world (mainly the United States/CA) from the European Union.
United States: the concept comes from the idea of “the right of people to be let alone”
European Union: the definition splits into two rights:
The first is tied directly to the dignity of the person as a human right, so the protection covers any violation of human dignity.
The second is set out in Article 7 of the Charter of Fundamental Rights, which protects privacy and family life and states that “everyone has the right to their privacy, that of their family, their home and their communications”.
So, how do we define privacy without falling back on a legal definition? Over the years, the definition that has made the most sense to me is the one Neil Richards gives in his book Why Privacy Matters. It is as simple as this: “Privacy is the degree to which human information is neither known nor used”.
A law with a constitutional basis
The first part of the law, the general provisions, establishes something essential: the law rests on personal data protection as set out at the constitutional level. It refers to the Constitution of the Republic of Chile, specifically Article 19 No. 12, on the freedom to express opinion and to inform. That is the first time the Constitution comes up, and to understand how the law works you first need to understand why the Constitution matters.
At the national level we have a pyramid that works roughly like this:
At the top of the pyramid sits the Constitution.
The Constitution is the supreme law, the Magna Carta, the law of laws. No rule stands above it and every other rule must yield to it. In Chile, the current text enshrines several rights, some of them fundamental, found in Article 19 under the heading “The Constitution guarantees to all persons”, which then sets out 26 subsections with specific rights.
Several of these articles and subsections have been amended since the data protection law came into force.
For example, Article 19 No. 1, on the right to life and to the physical and mental integrity of the person, states in its fifth paragraph that “[...] scientific and technological development shall be at the service of people and shall be carried out with respect for life and for physical and mental integrity. The law shall regulate the requirements, conditions and restrictions for its use on persons, and shall especially safeguard brain activity as well as the information derived from it”.
The same article then says: “Respect for and protection of the private life and honor of the person and their family, and likewise the protection of their personal data. The processing and protection of this data shall be carried out in the manner and under the conditions determined by law”. This is what gives data protection its constitutional grounding, something that was only amended in 2018.
Rights, how they are exercised and how little they are known
The law's main impact on citizens, backed by a ruling of the Constitutional Court, is “informational self-determination”, which sums up how people are protected from their personal information circulating in databases or in any other format.
Four key concepts come up here:
Data processing, data record or database, the party or parties doing the processing (the data controller and the data service provider) and personal data.
The distinction can be summed up in this table:
And what is personal data? Under the law, it is “anything relating to any information concerning natural persons, identified or identifiable”. And by “any information” we mean every kind of data that refers or links back to a person.
Categories of personal data
One distinction the whole body of legal literature makes is between ordinary personal data and sensitive data, the kind that needs stronger protection because of how much it matters. Sensitive data covers anything related to racial origin, political opinions, religious beliefs and physical characteristics, as well as data on health and sexuality (and it may include other categories depending on the circumstances).
This data is sensitive because using it can lead to arbitrary discrimination, bias or serious risks to a person's safety or integrity. That is why the law is stricter about what can be done with it, about the kind of consent required (the authorization we need) and about the care taken when processing it.
The law also created a special chapter for processing information related to finance, financial institutions and their records.
Some argue this was because of how sensitive that information is; others —with good reason— read it as a way to keep tighter control over the organizations that hold financial data.
Rights and guiding principles
Before we get into what organizations must (or cannot) do with data, we need to go over the principles that legitimize the use of data and the demands placed on organizations. They are:
Principle of legitimacy: data can only be processed when the law allows it or the data subject expressly consents to it. There are distinctions by sector —banking, health and so on— and we'll cover those in another post.
Principle of lawfulness and fairness: processing must be in good faith and must keep proper custody of the data you are responsible for.
Principle of transparency: it requires taking the measures needed to make the processing generally known, along with its purpose, the controller and any other information that gives data subjects guarantees.
Principle of purpose: data cannot be used for purposes other than the one it was collected for.
Principle of quality: this refers to the conditions under which data must be processed. We'll look at it in more detail when we cover the GDPR.
Principle of control: auditing and checking what is being done, why and on what grounds. It is a check on the work carried out by the party responsible for the record.
If you want to know what organizations are required to do, keep reading in the post on “the organization, the party responsible for the record and the legislative future”.
