ChileLey 21.719, express consent for sensitive personal data
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- From , process sensitive personal data (data revealing racial or ethnic origin, political, union or trade affiliation, socioeconomic situation, ideological or philosophical convictions or religious beliefs, and data on health, the human biological profile, biometrics, sex life, sexual orientation or gender identity) only with the data subject's express consent, unless an Article 16 exception applies.
- From , rely on the Article 16 exceptions to process sensitive personal data without consent only in the cases it lists, such as data the data subject has manifestly made public for the purposes of their publication, or processing indispensable to safeguard the life, health or integrity of a person who cannot consent.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 16 sets the consent rule and the exceptions for sensitive personal data. It names no log or record of the processing, and the controller's burden to show that a non-profit exception applies is a burden of proof and not a record. No audit, access party or retention period is named, and the article carries no territorial clause, so the hook is empty; the territorial rule of Article 1 bis is read on the row that cites it.
- Kind
- None
- As of
What this law does
Sensitive personal data are data that reveal racial or ethnic origin, political, union or trade affiliation, socioeconomic situation, ideological or philosophical convictions or religious beliefs, and data on health, the human biological profile, biometrics, sex life, sexual orientation and gender identity. Sensitive personal data may be processed only with the express consent of the data subject, given in a written or verbal statement or by an equivalent technological means.
Sensitive personal data may also be processed without consent where the data subject has manifestly made them public and the processing relates to the purposes for which they were published, or where the processing is indispensable to safeguard the life, health or physical or mental integrity of the data subject or another person, or the data subject is physically or legally unable to consent.
The amendments to Ley 19.628 made by the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.
When LexLint raises it
When your app profile says your app processes personal data or processes biometric data.
Back to the example · Lint your app
Page updated .