ChileLey 19.628, sobre Protección de la Vida Privada
Ley 19.628, sobre Protección de la Vida Privada (Ley sobre Protección de Datos de Carácter Personal)
In force since .
A comprehensive regime rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- Yes
- Audit expectation
- none
What it requires
- Obtain a lawful basis before processing personal data of a person in Chile through a registry or data bank, whether the processor is a public body or a private party, per Ley 19.628 Article 1.
- Be prepared to compensate patrimonial and moral damage caused by improper treatment of personal data; Article 23 arms the data subject with a direct civil action, joinable with the claim establishing the infraction.
These lines are LexLint's reading of the law's text. Also read by: Consejo para la Transparencia (CPLT), which the transparency law charges with overseeing compliance with Ley 19.628 by State administration bodies (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
The civil courts: the data subject applies to the juez de letras en lo civil (civil court judge) of the controller's domicile, who may fine a controller that fails to deliver information or make an ordered change on time, and may suspend the head of a public service that does so. The Act creates no data protection authority.
Settledness
The Consejo's remit under the transparency law is compliance with Ley 19.628 by State administration bodies, and its recommendations are addressed to those bodies.
- As of
- Guidance link
- https://www.consejotransparencia.cl/wp-content/uploads/instruccion/2024/05/Resolucion-304-EXENTA_07-DIC-2020.pdf
- Guidance body
- Consejo para la Transparencia (CPLT), which the transparency law charges with overseeing compliance with Ley 19.628 by State administration bodies
- Open questions
- Is a web page that anyone can open one of the "registros o recopilaciones de datos personales, públicos o privados, de acceso no restringido o reservado a los solicitantes" (records or compilations of personal data, public or private, whose access is not restricted or reserved to the requesters) that Article 2 letter i) calls fuentes accesibles al público, so that data a crawler collects from it falls under the Article 4 exemption from authorization?
What it reaches
Obligation class
Consent, Data subject rights
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- processing of personal data in registries or data banks by public bodies or by private parties (el tratamiento de los datos de carácter personal en registros o bancos de datos por organismos públicos o por particulares)
What it makes you log
What the log must hold
Actor identity, Access record
Logging duty
Article 5 lets the responsible party of a data bank set up an automated transmission procedure and requires that, for each request for personal data over an electronic network, a record is made of who asks, why, and what type of data is transmitted. The reason and purpose are not log-content values, so only the requester's identity and the type of data are listed. Article 5 is to be removed from by Ley 21.719. The primary-source page read here carries Articles 1 to 7 only, so nothing is said of Articles 8 onward. No audit, access party or retention period is named in Articles 1 to 7, and Article 1 has no territorial clause (the territorial rule is the Article 1 bis that Ley 21.719 adds, read on its own row), so the hook is empty.
- Kind
- Explicit
- As of
- Provision
- Article 5
- Trigger
- personal_data_processing
What this law does
Ley 19.628 governs the processing of personal data in registries or data banks by both public bodies and private parties, with an exception for processing carried out in the exercise of freedom of opinion and information.
Its Título V arms a data subject with a direct civil action: the controller, whether a private person or a public body, must compensate the patrimonial and moral damage caused by improper treatment of the data, and that damages claim may be brought together with the claim establishing the infraction itself, under summary civil procedure.
The statute remains the law in force in Chile as of this date; its substantive provisions are due to be superseded by Ley 21.719 on , and several of its articles already carry pending-amendment banners on the primary source pointing to that commencement date.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .