Inspiring Women in Law: Macarena Gatica examines Chile’s new Data Protection law and offers keys to its implementation in companies

Alessandri - After more than seven years of legislative processing, the draft law on personal data in Chile has been passed into law.

It is now up to the Constitutional Court to examine its constitutionality.

Latin Counsel spoke to Macarena Gatica, partner at Alessandri Abogados and leader of the firm’s Technology, Media, Telecommunications and Data Protection practice, about the real implications of this new law for companies and its implementation.

Latin Counsel: What does this new law seek to achieve?

Macarena Gatica: The new Personal Data Law in Chile seeks to strengthen the protection of citizens’ personal data, giving greater control of data to data subjects. It also establishes a regulatory framework under which organisations can process personal data.

LC: What are the key points of this law for companies to take into account?

MG: The processing of data with a risk-based approach and its appropriate management. New categories of data with specific regulation, new bases of lawfulness in which consent has requirements that change the way it is managed today. It creates the Data Protection Agency, the body in charge of supervising compliance with the law, with fines that in the case of repeated serious infringements can reach up to 4% of the previous year’s income.

LC: What are the main obligations for companies under this law?

MG: To prove the lawfulness of data processing (consent), to inform about data processing, to keep data confidential, to adopt security measures, to manage risks and to report breaches.

LC: What do you foresee as the impact on businesses?

MG: The biggest impact is on the work that the organisation has to do to achieve the new standard and compliance with the law. It involves costs associated with compliance assessment and gap identification processes, risk assessments, automating the capture and management of consent, as well as the exercise of Arco rights, establishing the necessary structure for risk management, among other conducts aimed at preventing breaches and associated fines.

LC: Do you think that Chilean companies are sufficiently prepared and trained for compliance with this law?

MG: In general, there are companies that have begun the process of adaptation, however, there are many that waited for the law to be passed. It should be remembered that Chile is not a country with a history or culture in these matters, so the implementation of adequate data protection policies and the adaptation of systems and processes will require considerable effort.