The economic benefits of being included in the Visa Waiver Program (VWP) with the US are remarkable. The ease of travel allows for the exchange of tourism between the countries, and other new economic opportunities through reduced friction caused by visa approval processes. Nonetheless, this program is often used as a mechanism to seek more data on the citizenry of participating countries, and Chile’s involvement in the VWP places the privacy rights of citizens at risk.

By Gus Hosein, Executive Director from Privacy International*

In the past decade the US Government has used the Visa Waiver Program to place pressure on other governments to hand over data on their citizens to the US Government. A country must meet certain requirements in order to be eligible to participate in the VWP, much of it centering around how data is shared between the two countries. This is problematic given the notoriously low legal protections the US Government provides for this data. US privacy law is amongst the weakest in the world, particularly as immigration and national security are used as exceptions to even basic safeguards. What is most problematic is that US law only protects US persons. Any data sent by the Chilean Government would be exempted from the US’s weak legal regime. When the US receives data on foreigners it customarily retains this information in its vast databases for 100 years.

Joining the VWP will mean that the United States now has access to significant amount of personal information of Chileans. This raises concerns regarding which Chilean authority would be responsible for deciding and managing information shared with the US, the possibility of the US sharing this data with third parties, as well as arbitrary refusal of access to the US because of potentially erroneous data in Chilean databases. A Chilean citizen who is mistreated on the basis of this data will have no right to redress under US law, and his or her data will continue to reside in the US without any real ability to appeal.

The VWP also requires member countries to adopt an ‘e-passport’. The establishment of a Chilean ‘e-passport’ will likely result in the Chilean Government establishing a database of biometrics. This includes an individual’s fingerprints, names, sex, date and place of birth, nationality, and passport number. Potentially more sensitive data could be included. The lack of a privacy law in Chile means that Chileans have no legal protections to ensure that the data is accurate, that it is not used for other purposes, and that is not shared with other departments or governments.

But there are concrete steps that the Chilean Government can take to protect the the privacy rights of their citizens. First, the Chilean Government must limit information sharing with the US authorities. Second, creating a national privacy law would require that any data shared with the US is accurate, and would place obligations upon Chilean authorities to provide Chileans with the necessary rights to ensure that their privacy is protected. Third, creating a national privacy commissioner will allow Chileans to appeal for assistance when problems arise, e.g. erroneous data results in Chileans’ being repeatedly detained at the US border. Fourth, the Chilean Government must seek strong assurances from the US about how their citizens’ data will be treated and protected. Finally, Chile needs to review all the personal data held by Government, to ensure that its information practices meet international standards to protect against abuses, errors, and other related risks to privacy.

While Chile is being offered the opportunity to join an elite club of countries whose citizens may travel to the US without a visa, the Chilean Government has failed to seek adequate protections for its citizens. These issues further justify and support the need for the implementation of strong data protection standards to ensure that the Chilean Government meets its international legal obligations to protect the privacy of its citizens. By adopting international best practices on the protection of personal information, Chileans could be better protected.

* Privacy International was founded in 1990, is based in England and was the first organization to campaign internationally on privacy issues.