In the context of the new digital services VAT provisions (DST) contained within the Chilean tax reform bill currently under discussion in Chilean Congress (the Bill), there are certain aspects that raise questions regarding the interaction between personal data, how its protection is regulated in Chile, and the manner in which the Chilean Internal Revenue Service (IRS) will be using taxpayers’ data in its assessment.
To put the discussion in context, it is relevant to note that Chilean VAT applies to certain services that are rendered or utilised in Chile. In the case of services rendered digitally, the Bill proposes to add new connection factors to determine whether a service rendered digitally is utilised in Chile (hence when the new VAT on DST will apply), and it does so in the manner of legal assumptions.
A service rendered digitally is presumed to be utilised in Chile if two of the following four situations occur together: (i) the Internet Protocol (IP) address of the device utilised by the user or other geolocation mechanism indicate the user is in Chile; (ii) the bank card, current account or any other means of payment used for the payment is issued or registered in Chile; (iii) the address stated by the user for invoicing or payment vouchers is located in Chile; (iv) that the subscriber identity module (SIM) of the mobile phone through which the service is received has a Chilean code.
Besides the above, the Bill proposes that the Chilean IRS will be enabled to use all technological means available to verify the tax compliance of this new VAT law provision. This is a very broad provision; however, we deem that user profiling, automated assessments and decisions, may be under analysis by Chilean authorities given the international context.
As it becomes evident, the Chilean IRS is being granted two very important tools by the Bill: firstly, access to a massive amount of personal data to perform tax assessments in what respects to VAT compliance; and, it is given free rein to apply technological tools to perform its assessment. These two aspects raise concerns about the level of protection that such data (and its owners) have in Chile. In this case, there is little doubt that Chilean data privacy law no. 19.628 (the law entitled the ‘Protection of Private Life’) is highly insufficient and outdated to protect individual rights to data privacy against the legitimate state interest to collect taxes.
The clash between the protection of personal data and the public interest is not well developed in the Chilean Protection of Private Life law. Indeed, they are set in a mostly unregulated grey-area that is in dire need of further revision. The sole reference for public sector data management and analysis is that such a law states that personal data processing can be done only when the law permits it, setting very few limitations. This approach is more developed in Europe. In particular, the example of the GDPR, which states that data processing can be performed by states if there is public interest, however it must be limited by the application of the proportionality test, which results in more advanced solutions that duly address this clash of rights. These regulations, which have users’ privacy within its goals, do not forget the relevance of data in the effective tax assessment by the authorities.
There is currently a bill held-up in Congress (since 2018) that addresses some of these conflict areas. When we do have new data protection provisions or laws, we will need to address challenges derived from such, in particular in regard to tax matters, as tax assessments are becoming ever more digitalised and data-centric.
There is no stopping the implementation of different kinds of digital taxes globally. Data protection regulations, as well as other areas of technological development and the law continue to overlap, meaning that the changes that technology and digitalisation bring to taxation will need to be monitored very closely.
Jonatan Israel
T: +56 2 29400126
Sandra Benedetto
T: +56 2 29400155
