Data Sharing Between Public Bodies: Limits and Challenges

The Argentine Case

In Argentina, a woman provided her telephone number and email address to ANSES (the National Social Security Administration) to process her pension. This data was subsequently shared amongst various government departments for purposes she never authorised. Ten years later, in the case of Torres Abad v. ANSES (CAF 49482/2016), the Argentine Supreme Court (“CSJN”) not only ordered ANSES to refrain from using that data for other purposes: it declared the regulations authorising that exchange to be unconstitutional.

Argentina’s Law No. 25,326 on the Protection of Personal Data establishes that consent is the rule for the transfer of personal data, but it enshrines such broad exceptions, including the exchange of data between government agencies “within the scope of their respective competences”, that, in practice, the rule was rendered meaningless. If all state activity falls under the exception, the exception becomes the rule. And that, the Court stated, infringes upon the rights to privacy and informational self-determination.

Public bodies under Law No. 19,628, as amended by Law No. 21,719

In Chile, Article 1 of Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719 (hereinafter, “New Law No. 19.628”) establishes that all processing of personal data carried out by “a natural or legal person, including public bodies”, is subject to its provisions. There is no exemption for the State; the inclusion is explicit.

For its part, Title IV specifically regulates processing by public bodies. Article 20 formally recognises them as data controllers, with all the principles and obligations that this entails, and establishes that they do not require the data subject’s consent to process their data, provided that the processing is carried out for the fulfilment of their legal functions and within the scope of their powers. This exception is not a privilege that exempts them from the requirements; it is simply a different legal basis with its own conditions.

Data sharing between public bodies 

Article 22 of the New Law No. 19,628 sets out the conditions for the communication or transfer of data between public bodies, and this is where the most significant difference from the Argentine framework lies: whilst the Argentine law permits the exchange of data between state agencies by generically invoking their ‘respective competences’, Article 22 of the Chilean law requires that the transfer be made for a specific purpose and prohibits the receiving body from using the data for other purposes.

The same provision allows for a second scenario: when data is required to grant benefits to the data subject, to avoid duplication of procedures, or to prevent the repeated request for information from the same citizens. This ground, aimed at efficiency and avoiding inconvenience to the data subject, has a broader scope, but always refers to the benefit of the citizen themselves, not the general interest of the State.

For the transfer to private entities, the rule is more stringent, with public bodies required to obtain the data subject’s consent, unless the transfer is necessary to carry out supervisory or inspection functions.

Finally, Article 22 imposes an obligation of active transparency not found in Argentine legislation: public bodies must publish monthly on their website the agreements signed with other public bodies regarding the transfer of data, an obligation overseen by the Agency.

The legal function of public bodies as the basis for lawfulness 

For public bodies, the basis of lawfulness does not derive from Articles 12 or 13, but from a special provision: Article 20 of Title IV. This article authorises them to process personal data without the data subject’s consent when the processing is carried out for the fulfilment of their legal functions and within the scope of their powers.

The legal basis is reasonable and necessary for the State to function, but it could be interpreted too broadly. A ‘legal function’ understood in general terms could become an all-encompassing authorisation, leaving data subjects without safeguards.

The law seeks to mitigate this risk through the principles that also apply to public bodies by express reference in Article 21. Thus, the principle of purpose requires that data be collected for specific, explicit and lawful purposes, and that processing be strictly limited to them. Meanwhile, the principle of proportionality requires that only data strictly necessary, appropriate and relevant to the stated purpose be processed. Thus, both operate as internal limits to the legal basis of Article 20; it is not sufficient to invoke the legal function in the abstract, but it must be demonstrated that the specific processing serves a particular purpose and that the data involved are the minimum necessary for that purpose.

Limitations on the legal function as a basis of lawfulness.

The specific legal basis for public bodies establishes an important limitation on the processing carried out by them. Given that the only legal basis available to public bodies is Article 20, and the list in Article 13 does not apply to them, a public body wishing to carry out processing that does not directly fall within a legal function assigned by law finds itself, in principle, without any possible authorisation.

This creates a significant practical problem: there are processing operations that public bodies carry out or might wish to carry out which are not related to a specific legal function. In the absence of a basis for lawfulness, the processing simply could not take place. The Personal Data Protection Agency will have to rule on how to resolve these cases, and that criteria will be decisive for the day-to-day functioning of the public sector.

Situation in Chile 

On 1 December 2026, the amendments introduced by Law No. 21,719 to Law No. 19,628 will come into full force, so there is still time for public bodies to adopt the necessary measures to comply with the regulations and ensure the protection of data subjects’ rights.

The interpretation of how specific the purpose must be and how close the link between the data and the competence invoked must be will depend on the future Personal Data Protection Agency.

In the meantime, public bodies should use this period to review their practices regarding the communication and transfer of personal data, ensuring that each data flow has a specific legal basis and a defined purpose. The data transfer agreements required by Article 22 cannot be empty formal documents; rather, they must accurately reflect what data is being transferred, under which regulation, for what purpose, and for how long.

Ultimately, a citizen who provides their data to a public service for a specific procedure has the right to ensure that their data is not circulated beyond that purpose. We hope that Argentina’s experience can help Chilean public bodies to understand the limits and obligations that apply to them.