The Chilean Senate is considering important legislation to regulate the protection and treatment of personal data and create a personal data protection authority. A Bill was approved by the Senate Constitution Committee in April 2018. This Report Card addresses the Committee-approved Bill (“The Bill”) but also comments on specific amendments that are being considered.
The Bill is a thoughtful, comprehensive effort modeled on the recently enacted European Union General Data Protection Regulation. As is always the case with broad and complex legislation, there are several provisions that create business uncertainty and risk, especially for startups and small businesses. Improvements to The Bill – and thoughtful regulatory guidance regarding implementation and enforcement – could promote compliance and improve certainty for business, investors and consumers.

In general terms, The Bill:

1. Establishes new rights, e.g., data portability and deletion;
2. Defines consent as a free, specific, unequivocal and informed manifestation; which must be granted in advance and be specific as to its purpose;
3. Establishes exceptions to consent (data relating to obligations of an economic, financial, banking or commercial nature; legitimate interest; when the processing of data is necessary for the formulation, exercise or defense of a right before the courts of law);
4. Perfects the concept of Public Access Sources, those sources that are publicly accessible (for example the Internet), without any legal restrictions or impediments to their access or use of the data;
5. Establishes greater regulation of sensitive data (including biometric data and data relating to the human biological profile) and of “special data” (children’s data; historical, statistical and scientific data; and geolocation data)
6. Grants data holders a limited right to request that no decision affecting him in a significant way be adopted exclusively based on the automated processing of his data;
7. Creates a Personal Data Protection Agency to oversee compliance and enforcement;
8. Creates a National Compliance and Sanctions Register;
9. Establishes new procedures for pursuing liability;
10. Regulates international data transfer;
11. Regulates the duty to adopt security measures, and obligations to report breaches of security measures;
12. Establishes the possibility for data controllers to adopt and certify a model for preventing breaches, associated with mitigating liability.

As noted in the chart above, the Bill does an admirable job of addressing many concerns. However, there are several concerns, some of which are particularly troublesome for small companies and startups:

1. Unusual Extraterritorial Jurisdiction. The principle of territoriality traditionally limits Chilean authority to people and activity within Chile’s borders. The Bill, however, seeks to regulate processors of data operating outside of Chile, including global activity that impacts Chilean residents and activity that concerns data of Chilean residents when they are outside of Chile’s borders.
   One concern is that global enforcement could overwhelm the Chilean Data Authority. Another concern is a risk that some service providers may choose to cease doing business inside of Chile or with Chilean citizens. A third concern is that businesses will be subjected to multiple governments’ regulation and enforcement, which will increase complexity, cost and risk.
2. Penalties Are Potentially Disproportionate and Unfairly Punitive. The Bill proposes very high fines and does not specify factors for regulators to consider that could mitigate their very harsh impact on small businesses. Additionally, the accessory sanction of suspending a firm’s ability to process personal data is highly punitive, perhaps unprecedented in Chilean law, and could result bankruptcy for digital media and data processing enterprises.
3. Problems with Consent. First, The Bill adopts a narrow GDPR principle that consent to data processing may be legally impossible when there is an “imbalance” between a person and the data controller or processor. However, The Bill does not adopt the narrow GDPR definition or otherwise define the “imbalance.” Potentially this provision could be used against data collectors to undermine vast amounts of legitimate activity.
   Additionally, The Bill requires consent to be specific as to the data’s use, informed and approved in advance of collection. This protects against a generalized risk of “uncertainty,” but it appears to prohibit data collectors from studying data creatively and discovering unexpected and valuable trends that could benefit data holders.
4. Obligations of Processers. The Bill assigns to Processers obligations to report data breaches to the Authority and to the Data Holders. However, a Processer is a technical role as compared to the Data Controller.  It seems that the Processer’s obligation should be to the Controller, and that the Controller’s obligation should be to the Authority and to Data Holders.

In addition to this commentary on The Committee Bill, three amendments under consideration cause concern:

1. Proposed expansion of “sensitive data” definition to include many types of data that historically have not been considered sensitive and which are not identified with a specific person. This expansion will substantially expand the compliance burden and the risks of non-compliance and does not seem necessary to protect consumers.
2. Requiring Data Controllers resident outside of Chile to register with the Chilean Data Authority. This requirement could inadvertently cause non-compliance (and risk serious fines) if enterprises do not know that a property is being accessed inside Chile or by Chilean residents.
3. Imposition of fines based on a company’s sales. Although this methodology appears to ensure proportionality of the fines, it risks unfair impact on startups and low-margin businesses if it does not consider these and other variables when penalties are decided.