/ Abusive clauses in personal data: Sernac calls for public consultation

The citizen consultation on abusive clauses in consumers’ personal data is available from February 9 to 19, 2022. We recommend reviewing this alert and your company’s consent and data processing clauses.

María Ignacia Ormeño Sarralde
Associate Attorney
Alessandri Abogados

Sernac recently published an interpretative circular letter on fairness criteria in the provisions contained in adhesion contracts referring to the collection and processing of consumers’ personal data.

This circular letter is issued under the new power of Sernac contained in Article 15 bis of Law No. 19,496 on Protection of Consumer Rights (LPDC) regarding personal data of consumers in a consumer relationship.

In it, the authority determines the parameters of control on the matter and explains that suppliers incorporate provisions relating to the treatment of personal data, either in the terms and conditions or in the privacy policies (PDP) generally published on their websites or online sales channels. According to Sernac, these provisions constitute adhesion contracts, as established in the LPDC, so there is an asymmetry of information and imbalance of bargaining power of consumers.

Main points addressed

1. Transparency of PDPs and of any provision or condition linked to the processing of personal data.

Every consumer has the right to truthful and timely information. There must be access to and comprehensibility of the clauses that make up a privacy policy. In addition, the degree of consumer knowledge depends on a prerequisite for the granting of consent i.e. “clear, understandable and unambiguous access to the general conditions thereof” (Article 12 LPDC).

Minimum PDP content:

• Data controller, specifying its contact details.
• Determination of the data being collected, indicating if they have any special quality (for example, if they constitute sensitive data);
• Basis of lawfulness;
• Specific processing operations you are authorizing (purposes);
• Data retention period or criteria for its determination;
• Indicate to whom the collected data may be communicated; and
• Rights of data holders and the procedure to enforce them.

2. The following shall be considered abusive clauses:

• Clauses that provide for the unilateral modification, suspension or termination of the contractual relationship.
• These clauses must be based on a valid consent, i.e., prior, express, written, voluntary, specific and informed authorization.
• Clauses that make the consumer responsible for the effects of eventual deficiencies, omissions or errors.
• It is forbidden for PDPs to charge the consumer with the consequences of non-compliance with the duties of professionalism and safety to be fulfilled by the supplier.
• Clauses containing absolute limitations of liability vis-à-vis the consumer.
• Clauses limiting or exempting the supplier’s liability for damages arising from data processing are considered abusive.
• Clauses that contravene contractual good faith.
• Clauses that are excessive or deviate from the typical objective that an average consumer seeks to satisfy through a consumer relationship are considered abusive. The supplier must respect the purpose of the contract and in no way may “exceed the justification or legitimate purpose of the use of the consumer’s personal data, which the consumer has presumably authorized”.

Examples of abusive clauses according to this circular letter:

• “delivering information to all kinds of third parties with whom the consumer has not contracted and which are extensive or excessive, considering the purpose indicated as justification by the supplier”.
• “that third parties outside the contractual relationship may send the consumer commercial or advertising messages, through direct marketing activities, personalized advertising, profiling and segmentation.”

Participate in the citizen consultation here.

If you require assistance for participation, please send an email to alessandri@alessandri.cl