Recently, the National Consumer Service (Sernac) issued two guidelines with relevant provisions regarding the processing of personal data.
I Interpretative Guideline on fairness criteria contained in standard form agreements referring to the collection and processing of personal data.
Sernac proposed the control and supervision of the clauses and stipulations contained in standard form agreements normally contained in “privacy policies” and “terms and conditions”, formulas that normally offers a wide array of clauses that deal with the processing of consumers’ personal data.
In this context, Sernac proposes five interpretative criteria. The first one refers to a form control, and the remaining ones to various “abusive clauses” that are usually contained in these policies. These are:
- Form control: transparency of privacy policies and of all stipulations related to the processing of consumers’ personal data.
This control means that the supplier must provide the consumer with transparent and specific information regarding what information and which personal data will be processed, in order to obtain from the consumer a valid authorization that enables the processing of data in the context of a consumer contract. This information must be specific, both in terms of the personal data that will be processed (processing activities), as well as the purpose of the processing. The fulfillment of this parameter, according to Sernac, determines the informed nature of the authorization given by the consumer for the processing of his/her data, in accordance with the consent criteria established by the “LPD” (Ley de Protección de Datos or the Data Protection Law of Chile).Sernac points out that excessively and unnecessarily long, disorganized, confusing or difficult to understand clauses and privacy policies should be avoided, such as those that lack a schematic order, or those that present visualization difficulties, among others.In addition to this, Sernac emphasizes the need for identification by consumers of what information concerning them will be collected and how it will be used, so that, if they wish, they can exercise their rights as data subjects.Thus, the Guideline states that privacy policies should allow consumers to easily identify: