One of the First South American Data Privacy Laws

Chile’s Law No. 19.628 Protection of Private Life 1999 is a Chilean data protection law that was passed in 1999. Although the Government of Chile proposed Bill No. 11144-07 Regulating the Processing and Protection of Personal Data and Creating the Data Privacy Authority in March of 2017, an updated data privacy law based largely on the European Union’s General Data Protection Regulation or GDPR, the legislative process concerning the bill has moved very slowly. As such, Chile’s Law No. 19.628 Protection of Private Life 1999 remains the legal means by which personal data may be collected and processed within the country, as it sets forth various requirements for data controllers and processors as it relates to data protection and personal privacy.

How are data controllers and processors defined under Chile’s Law No. 19.628 Protection of Private Life 1999?

Under Chile’s Law No. 19.628 Protection of Private Life 1999, a data controller is defined as “any natural or legal person, public or private, who decides on the purposes and means of the personal data processing, regardless of whether the data is processed directly by them or through a third party.” Conversely, a data processor is defined as “any person who processes data on behalf of or in the name of the data controller.” Alternatively, the law defines a data subject as “any natural person, identified or identifiable, to whom the personal data concerns or refers”, while personal data is defined as “any information related to or referring to a natural person, identified or identifiable through means that can reasonably be used.”

What are the requirements of data controllers and processors under Chile’s Law No. 19.628 Protection of Private Life 1999?

Chile’s Law No. 19.628 Protection of Private Life 1999 establishes various data protection principles that data controllers and processors operating within the country are responsible for following when engaging in data processing activities, though these principles are more general and less specific than the data protection principles of more modern data protection laws. To this end, the data protection principles set forth in Chile’s Law No. 19.628 Protection of Private Life 1999 include:

• Lawfulness.
• The purpose of the data processing.
• Proportionality and minimization.
• Quality.
• Accountability.
• Security.
• Transparency.
• Confidentiality.

What are the rights of Chilean citizens under Chile’s Law No. 19.628 Protection of Private Life 1999?

Under Chile’s Law No. 19.628 Protection of Private Life 1999, Chilean citizens are entitled to the following data privacy protection rights:

• The right to access.
• The right to rectification.
• The right to erasure.
• The right to object or opt-out.
• The right to data portability.
• The right not to be subject to automated decision-making.

In terms of penalties with respect to non-compliance with the law, Chile’s Law No. 19.628 Protection of Private Life 1999 does not establish a data protection authority or other related organization that is responsible for enforcing the provisions of the law. Furthermore, the law does not outline a detailed list of violations with respect to the law. However, the fines established by the bill can range from $3,500 to $750,000, depending on the scope and severity of the violation, as such violations are handled in court. Additionally, Chile’s Law No. 19.628 Protection of Private Life 1999 also states that data controllers also face punishments including “the suspension of the data processing for 30 days, which may be extended for the same period.”

Despite the fact that many countries without South American have enacted modern comprehensive data protection laws in recent years, such as Brazil’s General Data Protection Law or LGPD and Ecuador’s Personal Data Protection Law, the passing of an updated Chilean data protection law remains mired in the bureaucracy of the legislative process. Nevertheless, Chile’s Law No. 19.628 Protection of Private Life 1999 does provide data subjects within the country with a significant level of privacy protection, even the provisions of the law are somewhat outdated by more modern standards. As such, the Government of Chile is sure to continue working on passing some form of updated data protection legislation, as the country has shown to prioritize the personal privacy of its citizens through the passing of Chile’s Law No. 19.628 Protection of Private Life 1999 more than 20 years ago.