/ Personal data protection and consumption

Sernac’s analysis causes concern because it is unaware of the benefits that the use of artificial intelligence and data processing can generate for consumers. Overprotection limits the freedom of consumers who value a personalized service.

Macarena Gatica L.
Partner
Alessandri Abogados

Today more than ever, the importance of personal data in consumption is undeniable. Consumers value when we receive a personalized offer that suits our needs and preferences. For its part, the supplier seeks to know more about its consumers in order to present a relevant and timely offer.

The personalized offer is the result of the analysis of our personal data and generally of models that make it possible to predict our inclination to contract a certain product, service or need.

On December 24, 2021, the so-called pro-consumer law was published, which contemplates in its article 15 bis the power of Sernac to supervise regarding to consumers’ personal data, which may give rise to collective actions.

In accordance with this law, Sernac has issued two interpretative circular letters related to consumers’ personal data. The first one concerns the use of artificial intelligence systems in the consumer relationship and the second one on fairness criteria in the provisions contained in standard-form agreements, referring to the collection and processing of consumers’ personal data.

Personal data are governed by Article 19 No. 4 of the Chilean Constitution, which states that the processing and protection of personal data shall be carried out in the manner determined by law. This law is 19,628 on privacy protection. Therefore, this mandate of article 15 bis must be in accordance with the regulation contemplated in the special law.

However, in the circular letter on abusive clauses in privacy policies, Sernac interprets the protection of consumers’ personal data by applying the consumer protection law. For example, Sernac states that what the data holder must be informed of is: the identity of the data controller (with its contact information), the basis for the lawfulness of the data processing, what data are processed, whether they belong to any special category, the purposes, whether the data collected will be used for profiling operations, the period during which the provider will keep the data, the recipients to whom the data collected may be communicated, the consumer’s rights and the procedure for exercising them. However, law 19,628 expressly states that only the purposes of the data processing and the possibility that the data may be communicated to third parties must be informed.

The question arises as to whether Sernac can interpret the processing of consumers’ personal data by applying law 19,496 on consumer protection and, as a consequence, modify the current law on data protection. The nature of the relationship that exists between the data subject and the data controller is different from a consumer relationship, mainly because the data subject as a general rule can always revoke the authorization/consent given for the processing of his/her personal data.

Sernac’s analysis causes concern because in both interpretative circular letters it omits the benefits that the use of artificial intelligence and data processing can generate to consumers. The overprotection of this agency limits the freedom of consumers who value a personalized service.

Some will say that the aforementioned circular letters are based on Article 15 bis and they are undoubtedly correct. Today Sernac has the power to watch over consumers’ personal data, however, the question is which law should be applied to take care of them.