“Technology continues to evolve every day, so it is a priority to consolidate regulations that modernize and strengthen privacy protection in Chile.”
The protection of personal data is fundamental to the development of society, since, as Juan Maldonado, Chief Technology Officer, tells us, “this refers to the practice and set of measures aimed at to protect and guarantee privacy of the information that uniquely identifies a person”
Maldonado continues, “Some personal data usually includes: names, addresses, telephone numbers, emails, biometric data, medical history, or any other information that is linked to a person.”
Understanding this, the need becomes evident. strengthen and update legislation existing digital resources, to adapt them to international standards and technological advances.
Let's start by understanding the details of the previous standard, the Law 19.628The law, enacted in 1999, is over 20 years old. William Guzmán, Presales Solution Expert, explains, “Considering the numerous and enormous advances in Information Technology, it was more than necessary to review this law.”
This law defined basic concepts in the area of Information Technology and Data Governance, such as:
• Data storage: To preserve or safeguard the data in a record or database.
• Data blocking: Temporary suspension of any operation involving the processing of stored data.
• Communication or data transmission: To disclose personal data in any way to persons other than the data subject, whether identified or unidentified.
• Some types of data: Outdated, statistical, personal or sensitive personal data.
• Data deletion or cancellation: Directly related to the data lifecycle in software development projects.
• Publicly accessible sources.
• Data modification.
• Public bodies.
• Data dissociation procedure: Any processing of personal data in such a way that the information obtained cannot be associated with a specific or identifiable person.
• Registry or database and their respective responsible party
• Owner and Processing of the data.
From these points arises a very important question…
What are the main changes that the new law will introduce?
Guzmán explains that, “a change introduced in this law (Article 2) contemplates the “Commercialization of databases”This is a significant change, as it defines this practice as "any operation related to the transfer or acquisition of personal data, whether through monetary payment or in kind, exchange of goods, or for interests involved between those who carry out the transfer of these data."
This change cannot be viewed in isolation, as it is related to another: the use of personal data. Guzmán adds that, “in order for our personal data to be marketed (among other uses), certain measures have been incorporated 3 important conditions (Article 4)”
a) The holder authorizes the processing of your data for a specific purpose.
b) Treatment may be necessary, as it is found The integrity of the holder is compromised.
c) The treatment may be necessary from someone state agency.
It is also relevant to consider that Law 21.096 allowed the addition to the National Constitution, in Chapter III ("ON CONSTITUTIONAL RIGHTS AND DUTIES"), of the Law 21.096 allowed adding to the National Constitution, in Chapter III ("ON CONSTITUTIONAL RIGHTS AND DUTIES") the right to the protection of personal data, at the same level as the right to respect and protection of private life and the honor of individuals.
How can companies adapt to the new regulations?
As a starting point, Juan Maldonado, Chief Technology Officer, states the following, “organizations have a duty to re-evaluate how they handle personal data to then implement a strategy that fully complies with the requirements of the regulations.”
“Current data protection needs require companies to adjust their procedures and policies,” Maldonado concludes.
On the other hand, for regulations to be truly effective, companies will need to take action. William Guzmán adds that "a first step companies could take would be..." generate a catalog with the data that they are receiving, storing, processing and consuming from people within the national territory.”
In other words, “companies should have full knowledge of the information they are working with and thus be able to identify if they have the proper authorization "by each user," Guzmán concludes.
In detail, the points that organizations must comply with range from ensuring consent and confidentiality, implementing a responsible and ethical data processing process, and avoiding infringements through prevention.
What obligations do those responsible for processing personal data have?
Entities or organizations that may be called “databases” are obliged to report William explains to each individual (who has provided and authorized the use of their information) the specific purpose and legitimacy of their data, along with the use that may be given over time.
It is important that we as users understand that “The authorization to data processing can be revoked"Without retroactive effect." That is, once we have authorized access to our data, we can change our minds and revoke this authorization, and this access (along with its possible consequences) would only apply from the moment of revocation.
Javier Linares, Head of Security and Innovation, adds to this information, “another duty of those responsible for data processing is to establish timely security policies and report any vulnerabilities they may have.”
What will be the impact of this law on security?
Currently personal data is exposed within the internet and on various platforms, being used and exploited.
This new law presents the perfect opportunity to boost security standards; in this regard, Linares states the following, “The protection of each person's information should be a right for avoid that they are victims of a data breach"
Therefore, this law will have a positive impact on people, being a key element in safeguarding security, minimizing leaks and misuse of data.
To conclude, Linares emphasizes a vital point: “It’s not just the law, we must also be responsible for our data personal and avoid sharing them on unauthorized sites within the internet, as they can be exposed and used by cybercriminals for scams, theft, and much more.”
References:
Ref 1: https://www.welivesecurity.com/es/privacidad/nueva-ley-datos-personales-chile/
Ref 4: https://www.bcn.cl/delibera/show_iniciativa?id_colegio=2190&idnac=1&patro=0&nro_torneo=2017