Companies that use databases will have to reevaluate their strategies to comply with the new regulation.
The recent approval of the Personal Data Protection Bill marks an important milestone in the regulation of the treatment of personal data in Chile, and its impact will be particularly significant for the advertising industry, which has traditionally relied on databases to segment and reach specific audiences.
Until now, the sale and use of databases, including those containing publicly available information, has been a mainstay of the business model of many companies in the sector. However, this scenario will change drastically once the new regulations come into force.
One of the most critical points of the new legislation is the purpose principle, which requires that “personal data must be collected for specific, explicit and lawful purposes”.
This implies that data may not be reused for purposes other than those reported at the time of collection, unless these purposes are compatible with the original ones.
This change will seriously affect many of the current databases, which were built under a regulatory framework that allowed the free use of public information, such as telephone numbers or e-mail addresses obtained by various means, in addition to allowing consent in generic terms on the part of the data owner, without entailing in practice a greater risk in the event of using the information for purposes beyond those authorized.
With the new law, not only will access to such data be more regulated, but the indiscriminate use of the information will be prohibited, unless the processing complies with the principles of lawfulness and proportionality.
According to these principles, “the personal data processed must be strictly limited to that which is necessary, adequate and relevant in relation to the purposes of the processing”.
In addition, the new law states that “personal data may be kept only for the period of time necessary to fulfill the purposes of the processing, after which they must be deleted or anonymized, without prejudice to the exceptions established by law. A longer period of time requires legal authorization or consent of the holder”.
This adjustment obliges companies to create new consent models that allow data subjects to authorize the use of their data in accordance with the new principles of the regulation.
Likewise, those who buy or use databases must take contractual safeguards to ensure that the supplier complies with the new legal requirements.
In other words, they must include contractual clauses that ensure indemnification in the event that the data does not comply with the regulations, thus mitigating the risk of incurring in infringements due to third party practices. This becomes even more important considering the heavy penalties that are contemplated for infringement of this regulation.
Consequently, the challenge for the advertising industry will be twofold:
- On the one hand, they will have to ensure compliance with the new legal requirements, which will involve reviewing and, in many cases, restructuring their current data processing practices.
- On the other hand, those who manage to adapt to this new standard will be able to take advantage of a competitive advantage in a market that will be under more rigorous scrutiny.
In conclusion, the advertising industry that uses databases will have to rethink its strategies in light of the new legislation. Adaptation will not only be a legal obligation, but an opportunity to innovate and strengthen the relationship with consumers in an environment where ethical data management will be increasingly valued.
For more information on these issues, please contact our IP, Tech and Data team:
Eugenio Gormáz | Partner | egormaz@az.cl
Antonia Nudman | Senior Associate | anudman@az.cl
Carlos Lazcano | Senior Associate | clazcano@az.cl
Fernanda Rodríguez | Associate | frodriguez@az.cl
Esteban Orhanovic | Associate | eorhanovic@az.cl
Be part of our multimedia platform and receive the latest legal news, events, podcazt and webinars.
