Accountability of Facebook and other businesses in Chile: personal data protection in the digital age

• Pages: 69-110
• Author: Vivian Newman-Pont,Daniel Ospina-Celis,Juan Carlos Upegui

69

Working Paper 10

ACCOUNTABILITY OF FACEBOOK AND OTHER

BUSINESSES IN CHILE: PERSONAL DATA

PROTECTION IN THE DIGITAL AGE

Paloma Herrera

Pablo Viollier

e objective of this report is to evaluate the preparedness of the Chilean

legal regime to address the new dynamics of the digital age and its capac-

ity to hold companies with a data-driven business model (CDDBM) ac-

countable.82

To this end, this report will be div ided into ve sections. In Section

1, we select four CDDBMs and describe the criteria to choose said com-

panies as representative of four categories: 1) large Internet companies;

2) intermediate companies; 3) start-ups; and 4) established companies.

We will characterize and evaluate four companies in this paper: Facebook,

PedidosYa, AI, and Falabella.

In Section 2, we describe and evaluate the operations of these CD-

DBMs. is characterization will be based on a study of the distinct terms

and conditions of the selected companies’ products and will revolve

around four analysis categories: 1) source of data processed; 2) process-

ing performed; 3) purpose of the processing; and 4) relationship with

Google, Amazon, Facebook, Amazon, and Microso (GAFAM).83

82. Throughout this report, the CDDBMs are understood as those companies

with a “business model that relies on data as a key resource” (Hartmann

et al. 2014, 6).

83. Note that this report will evaluate the business model of these four particu-

lar companies; therefore, the conclusions we may reach regarding them

are not necessarily applicable to other companies of the same market seg-

ment or with a similar business model.

BACK TO TOC

70 Data Feast: Enterprises and Personal Data in Latin America

In Section3, we aim to evaluate the preparedness of the Chilean data

protection legal regime to address the new dynamics of the digital age.

Specically, this analysis will be divided into two parts. First, we will study

the activities or dynamics of the digital age and of the companies selected

that are inadequately regulated by the national data protection law. Sec-

ond, we analyze the territorial scope of application of the data protection

regulation and its extraterritorial application to the CDDBMs studied.

For this, we analyze the contents of Law N°19.628 on the protec-

tion of privacy and other national regulations governing the collection,

processing, and storage of personal data.84 Since Chile is undergoing a

legislative reform of its data protection regulations, we will compare the

regulations currently in force under Law N°19.628 and those proposed in

the bill that regulates the protection and processing of personal data and

creates the Personal Data Protection Agency (2017), currently under dis-

cussion. Finallyand where relevantwe will use the European Union

General Data Protection Regulations (GDPR) as benchmark to evaluate

the relevance and level of protection of the regulations studied.

Section 4 addresses the mechanisms to enforce the data protection

law. Specically, we seek to determine whether the habeas data procedure,

contained in Law N°19.628 (of a judicial nature), provides sucient safe-

guards to comply with the law, exercise the data subjects’ rights, and the

legal system’s capacity to hold the CDDBMs accountable.

Finally, we make preliminary recommendations to improve the

Chilean legal system’s capacity to face the challenge of the new dynamics

of the digital age and business driven by the processing of personal data.

1. Methodology

e methodology used in this report is based on a review and analysis of

the privacy policies and terms of use published by the CDDBMSs on their

websites, as described in Annex1 of this report. Furthermore, we comple-

ment the research with information obtained from media statements is-

sued by the CDDBMs about their operations and business methodology.

e analysis also includes a study of the national regulation, specically

Law N°19.628, and the amendments being discussed, as well as the provi-

sions of the GDPR.

84. Ley N° 19.628, “Sobre protección de la vida privada,” Ministerio Secre-

taría General de la Presidencia. August 18, 1999. https://www.leychile.cl/

Navegar?idNorma=141599

BACK TO TOC

71

Working Paper 10

To complete this analysis, we held a focus group on October 4, 2019.

Eleven representatives of the industry, civil society, technical community,

public entities, and legal oces specialized on the subject aended this

meeting. e remarks made by the participants of the focus group are

transcribed to complement the analysis of the legal regime to compile the

opinions of the actors participating in the debate around data protection in

Chile.

2. Selection of CDDBMs

Although the systemic storage of data by corporations and public enti-

ties is usual practice in the 21st century, the evolution and proliferation of

information and communication technologies (ICTs) has impacted how

CDDBMs process and manage data. e main characteristic CDDBMs

share, regardless of their size, volume, or how consolidated they are in the

market, is that they process data or use the information they obtain to in-

novate and create new products. is way, companies focus their actions

on using this information to aract more customers and users to their re-

spective businesses (Diaz and Zaki2015).

Within the national context, a report prepared by International Data

Corporation (IDC 2018) predicts that 60% of the expenditure on IT by

companies for the 2019–2020 period will be invested in technologies

such as cloud computing, big data, Internet of things (IoT), and Arti-

cial Intelligence (AI) to improve their productivity and cut their expens-

es. In turn, regarding AI, a study conducted by Technology Visio2019

(Accenture Technology Vision2019) showed that 46% of Chilean execu-

tives surveyed said that their organization has adopted AI, whereas 29%

claim the same worldwide (TrendTic2019).

We selected four CDDBMs to describe and analyze the Chilean situ-

ation, considering their consolidation in the Chilean market and classify-

ing them into four categories: 1) large Internet companies, 2) intermedi-

ate companies, 3) start-ups, and 4) established companies.

2.1. Large Internet Companies

For this category, we selected Facebook Inc. as one of the companies

grouped under the acronym GAFAM (Google, Amazon, Facebook, Apple,

and Microso), known for its dominant position in the information and

technology market. We selected this company because it has 2.271billion

active users worldwide (We Are Social and Hootsuite, 2019), and over

BACK TO TOC