Consent
May consent be used as a legal basis for processing worker information? (Y/N – if N, please explain)
Yes.
Are there any specific worker data collections or processing operations that require prior consent? (Y/N – if Y, when is consent required)
Yes. Employers must inform to their employees about the measures of surveillance or tracking that are applied in the employer's facilities and must require its express and written consent.
Are there exceptions that will allow employers to collect and treat workers data without consent? (Y/N – if Y, list the exceptions)
Yes. According to article 4 of the Chilean data protection law (Law N° 19.628) employers may treat employees' data without employees' consent when personal data is collected from publicly accessible sources, and is of financial, banking or commercial nature, or are contained in lists related to a category of persons that merely indicate background information such as the individuals´ membership in that category, his/her profession or activity, educational qualifications, address or date of birth; or are required for commercial communications with direct response or direct marketing or sale of products or services.
Privacy Notice
Is the company required to provide a privacy notice to workers? (Y/N)
No.
Does the worker privacy notice need to address security measures?
No.
Are there any other unique disclosure requirements with respect to the privacy notice (e.g. list data retention periods, state legitimate bases, etc.)?
Yes. Employee must be duly informed about the purpose for which the data is collected and its possible communication to the public.
Data Subject Rights
Are there data subject rights for workers? (Y/N – if Y, please list)
Yes. Workers have the same rights as any data subject (i.e. rights of information, modification, deletion and blocking, etc).
What is the timeframe to respond to data subject requests from workers?
In case of a workers request the timeframe is 2 business days (Chilean data protection law N° 19,628).
Are there exceptions to responding to data subject requests from workers?
Yes. Requests may be denied when they prevent or hinder the due fulfillment of the auditing functions of the required public body, or affects the reserve or secrecy established in legal or regulatory provisions, the security of the Nation or the national interest.
Special Rules for Worker Information
Are there employment rules about privacy-related discrimination (e.g., unlawful to terminate employment due to worker submitting an access request)?
There are no specific employment rules about privacy related discrimination.
Are there any unique requirements for transfers of employee information to third parties (i.e., contractual restrictions or otherwise)?
Yes. Generic rules of Chilean data protection law (Law N° 19,628) are also applicable to employee since those who are responsible of the personal data processing are liable for the personal data they have and process, must keep secret and are liable of all damages caused to the data subject by the infringement of the legal framework.
Are there rules about automated decision making involving workers (e.g., hiring decisions)?
No.
Are there rules about processing sensitive information or information about worker households or families (e.g., biometric data, health/medical information, sexual orientation, religious affiliation, union membership, etc.)?
Yes. Such information is considered "sensitive data" by the Chilean data protection law (Law N° 19,628), and it may be processed only when authorized by law or by the data subject, or when the data is necessary for the determination or granting of health benefits that correspond to the data subject.
Are there specific security requirements for storing and processing worker information?
No. The general regime is also applicable for worker information.
Are there rules about using worker information for marketing?
Yes. Generic rules about use of personal data for marketing is applicable also to worker information for marketing. Therefore, written consent is needed.
Are there rules about surveillance of workers?
Yes. Employers must inform to their employees about the measures of surveillance that are applied in the employer's facilities. The information must be provided in the Internal Rules of Order, Hygiene and Safety of the employer.
Are there other specific privacy rules or issues involving worker information (e.g., BYOD policies, monitoring technology use, automated tracking of workers)?
Yes. According to article 152 quáter L of the Chilean
Labor Code, employees who render services from their own homes or
other site chosen by them, cannot be forced by the employer to use
their own personal devices to do their work.
Regarding to automated tracking of workers, even though there are
no specific rules, the Labor Courts have emphasized that
surveillance measures must be concordant with employees dignity and
privacy, therefore, automated tracking could be challenged in a
Fundamental Rights Tutelage Procedure.
Government and Recourse
Is there a legislative body or government entity that regulates employment-related privacy matters?
Yes. The Chilean Labor Board (Dirección del Trabajo).
In the event of a violation, is the recourse regulatory, a private right of action, or other?
Both.
Expected Changes to Worker Privacy Laws:
Yes. A bill of law is being discussed in the Chilean Congress which seeks to modernize Chilean data protection legislation and reeplace the current data proteciton law. However, there is no estimated date of when this bill should be approved and enter into force.
B2B Data
Is business-to-business (B2B) data treated differently than consumer or employee data? (Y/N – If yes, please explain).
Yes. The Chilean data protection law (Law N° 19,628) is only applicable to natural persons, not applicable to legal entities.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
