Chile: The Council for Transparency (CPLT) proposes amendments to regulations on the rights and duties of patients in order to fill some gaps in the processing of personal data.
The bill would allow the transfer of information on people affected by the Coronavirus between authorized agencies to prevent further spread of the virus. However, CPLT noted that the bill could be more rigorous in its drafting, as the current wording of the bill would allow any declaration of a pandemic to result in the publication of data from clinical records, which would go beyond the legitimate purpose of processing such data.
The CPLT therefore proposed that the application of this authorisation for the transfer of personal data should be restricted to authorised bodies only and for specified periods of time. Furthermore, the CPLT stressed the importance of, inter alia, anonymizing and erasing data that could identify an individual, informing individuals about the processing of their data and the purpose of such processing, and maintaining the principles of purpose, proportionality and accountability by minimizing data.
The project seeks to authorize in Law No. 20,584, the transfer of information between authorities that must necessarily be aware of the population affected by a pandemic or epidemic in order to prevent the spread of the disease among the population. Therefore, the initiative proposes that this transfer of information can only be made between the Ministry of Health, the Health Services, the Health SEREMI, the Order and Security Forces, and in the event of a Constitutional State of Emergency, the Armed Forces.
- “To make this authorization extend beyond the legitimate purposes of extraordinary situation and that implies risks for the citizens by the processing of sensitive data”. “We propose -from the CPLT- to restrict the application of this authorization to the processing of sensitive data in the different State bodies indicated in the project, to periods included within states of constitutional exception for reasons of health emergency”.
- Anonymize data or use pseudonyms
- Three principles: purpose, proportionality and responsibility.
- “Give a signal to the public sector that this information is sensitive, must be used with the highest standards of security and that strict measures must be established in its communication”.