/ Principle of Proportionality and Personal Data Protection

Macarena Gatica L.
Partner

The value of data is increasing due to digital transformation, data-driven approaches, and AI, and it is common to hear that the amount of data makes a difference when predicting behaviors. Therefore, it is crucial for organizations to consider the changes this new regulation will generate in their businesses.

As the personal data protection bill (Bulletin 11,144-07) progresses into its final stages, we frequently receive the question: what measures should be taken to ensure compliance with the law?

This legal initiative expressly mandates the adoption of measures to prevent infractions, that is, due diligence aimed at ensuring compliance with the law.

One of the key aspects of the new regulation is the principle of proportionality, which means that only the data necessary for achieving the purposes (previously communicated to the data subject) should be processed, and only for the time required to fulfill those purposes. How can this principle be achieved when the norm has been to process data without any limitations beyond the purpose?

Ben Brook, founder and CEO of Transcend, who spoke a few weeks ago at the IAPP Global Summit in Washington DC, explained: “Data should be considered like a library, every piece of data (book) that enters, leaves, and returns should be recorded.” He also mentioned the “5W” rule: “what, who, where, when, why.” What data is entering, who is its owner, where it is stored (systems where the information is processed), when (duration of data processing), and finally why, meaning the purpose of that processing. Regarding this last aspect, he recommended analyzing the notice (or privacy policy) by assigning one or more of the purposes informed in that document to each piece of registered data.

All of the above must be duly documented, potentially materializing in a Data Processing Register, which will allow the organization to demonstrate due diligence in complying with the aforementioned regulation.

The value of data is increasing due to digital transformation, data-driven approaches, and AI, and it is common to hear that the amount of data makes a difference when predicting behaviors. Therefore, it is crucial for organizations to consider the changes this new regulation will generate in their businesses, with particular emphasis on data minimization.