/ Progress on Personal Data Bill in 2022
January 16, 2023The most relevant issues that have undergone modifications in the second constitutional stage of Bill No. 11,144-07, and that deserve to be followed up, are consent regarding personal data, public access sources, fines, among others.
Macarena Gatica
Partner
Alessandri Abogados
During 2022, the bill on personal data was discussed in the second constitutional stage in the Constitution, Legislation and Justice Committee of the Chamber of Deputies. The willingness of said committee to listen to experts on the subject is noteworthy. I have had the honor to participate and contribute from the point of view of experience, to collaborate so that the country has a regulation that adequately protects personal data, which since 2018 is a fundamental right.
Segpres organized two working tables, one with the advisors of the deputies that make up the commission and others with academics, civil society, experts and trade associations, which has allowed speeding up the processing by achieving consensus proposals, which are then submitted to the committee for review and vote.
Regarding the most relevant issues that have undergone modifications in this procedure and that deserve follow-up are:
a. Consent: with respect to personal data, it is added that consent must be express, equating it to the standard for sensitive personal data. It is clear the role of consent that the deputies have established, without noticing that there are other bases of lawfulness, such as the law, the contract and the legitimate interest, which detracts from the spirit of the regulation that was sent by the Senate.
b. Sources of public access: the elimination of these sources has been discussed as an exception to the principle of purpose and consent.
i. Data from publicly accessible sources are eliminated as an exception to the purpose.
ii. Regarding article 13 that regulates other bases of legality, public access sources are eliminated as a legal basis.
c. Fines: the floors of the fine brackets are eliminated and new amounts are established with respect to serious and very serious fines, subject to income percentages. In the case of serious infringements, the fines are 2% of the company’s income for the previous year with a cap of UTM 10,000 and in the case of very serious infringements, the fines are 4% of the company’s income for the previous year with a cap of UTM 20,000. In the case of repeat offenses, the fines are multiplied by three.
d. Control body: Representative Soto presented an indication, reintroducing the Council for Transparency as a control body in matters of data protection. The vote on this indication was pending, since there is no consensus at the working table with the representatives’ advisors. This indication should be rejected outright, since the matter is an exclusive initiative of the President of the Republic.
e. 15 bis law 19,496: The executive branch presented two indications regarding the supervisory powers of Sernac in matters of data protection in a consumer relationship. In the first place, the principle of coordination between the Data Protection Agency and Sernac was established. However, another indication that revokes the article in reference was presented, in order to eliminate any possibility of conflict of interest between both agencies, in the understanding that such power of Sernac would not make sense since there is a body with competence in data protection. However, Article 2 bis of Law 19,496 remains in force, specifically in relation to the collective actions that may be exercised by Sernac and the Consumer Associations.
f. Legal vacancy. The transitory articles are modified, establishing a general legal vacancy of 24 months from the publication of the law.
The week of January 16, 2023, two sessions of the Commission were held, where the bill under analysis was discussed. Currently, only the indication presented in relation to the institutional framework is pending. The executive expects the law to be enacted during the first half of the current year.