News

Chilean data privacy new regulation: based and far from the GDPR

For 7 years Chilean Congress debated the amendment of Law 19.628 concerning data privacy. Finally, on December 13, 2024, the new regulation was published and is set to come into force on December 1st, 2026.

For decades, Chilean regulations have adhered to EU standards, which appeared. to be a good reference. However, our cultural, economic and social progress do not always align with these regulations. In fact, Law 19,628 (data privacy) followed the Spanish regulation in effect during the 1980s. Today, companies and organizations are making significant efforts and investing scarce resources to comply with the new regulation, leading to substantial changes in their processes and, in many cases, their business models

In terms of data protection, congressmen were inspired by the GDPR. The original bill closely resembled the European standard; however, over the seven years of discussion, changes were introduced that deviated from these guidelines. As a result, we now have a country with a limited culture of data privacy and a regulation inspired by the GDPR but with some originality in key areas, leading to challenges in interpretation and implementation. Uncertainty prevails, and GDPR jurisprudence will not always serve as a suitable guide, further complicated by unclear texts

An example of this is the concept of legitimate interest, the Law states: “When the processing is necessary for the satisfaction of legitimate interests of the data controller or a third party, provided that the rights and freedoms of the data subject are not affected thereby. In any case, the holder may always demand to be informed about the processing that affects him/her, and the legitimate interest based on which such processing is carried out We believe that the impact on the right is different from the override by the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data as stated by the GDPR. The Chilean wording does not give rise to a legitimate interest assessment (LIA) or weighting, as the right of the data owner would always be affected to some extent. Therefore, it will be impossible to apply this legal basis

Our hope lies in the interpretative powers of the new data protection authority. In this case, we may benefit if they follow GDPR jurisprudence.

 

Article provided by INPLP member: Macarena Gatica (Alessandri Abogados, Chile)

 

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)