Colombia’s New Personal Data Protection Statute

A process that started in 2010 has concluded with the enactment of Law No. 1581 of 2012, the new personal data protection law in Colombia.

The new law, effective as of October 17, 2012, extensively regulates the general aspects of the Constitutional fundamental right of habeas data, or data privacy, which for more than 20 years has been developed by rulings of the Colombian Constitutional Court. Certain aspects of this right are already partially regulated by other statutes, such as Law 1266 of 2008 (limited to credit rating entities), and by the Colombian Criminal Code.

Highlights

The highlights of Law No. 1581 of 2012 are:

• The law applies to the processing of personal data of individuals (data of legal entities are excluded) within the Colombian territory and to the processing of personal data of Colombian residents which takes place abroad.

• Prior, express and informed consent is required for the processing of personal data. Tacit consent is not accepted.

• The processing of sensitive personal data is expressly regulated.

• Although the draft version of the law would have forbidden the processing of personal data of children (individuals under the age of 18), the Constitutional Court, in its ruling No. C-748 of 2011 (not published until July 31, 2012), which declared the law to be compliant with the Constitution, provided for the conditions under which this type of data can be processed (see report by the authors at WDPR, August 2012, page 29).

The Court stated in its ruling No. C-748 of 2011 that personal data of children can be processed as long as 1) the processing does not risk the priority of their fundamental rights; 2) the processing responds to a minor’s superior interests; and 3) the opinion of the minor is always taken into consideration for the processing.

• The recently created Deputy Superintendency for the Protection of Data, a branch within the Superintendency of Industry and Commerce (SIC), has been granted multiple faculties to impose fines on parties that violate the statute that could reach approximately U.S.$600,000 in 2012.

Other penalties include the temporary or permanent closure of the business of the infringer. The severity of the penalty will depend on the degree of the infringement and whether there is any recurrence of the infringement.

• Creation of a National Database Registry under the supervision of the Deputy Superintendency for the Protection of Data. The minimum information that this registry will contain will be specified in a secondary regulation to Law 1581.

• Cross-border transfer of personal data is allowed to countries that are deemed to have adequate levels of protection, pursuant to the pertinent provisions and regulations issued by the SIC. Factors related to adequacy were listed in the Constitutional Court’s ruling No. C-748 of 2011, and will soon be implemented through a secondary regulation of Law 1581.

According to the Constitutional Court’s ruling, the factors to determine whether a country has adequate levels of protection are that the country has data protection legislation that, at the very least, contains principles such as purpose of the processing, quality and proportionality of the data, transparency, security, access, rectification and opposition, restrictions on successive cross-border transfers and secondary or supplementary regulations. Also, a country will be considered adequate if it has an authority in charge of enforcing such above-mentioned data protection legislation.

Nevertheless, it remains to be seen how adequacy will be articulated by the government in the regulations that are being drafted in this regard.

• Law 1581 also gives the Colombian government the faculty to issue further regulations to implement binding corporate rules as a mechanism to ease cross-border transfer of personal data and allow for more lenient treatment of misdemeanors.

• A six-month transition period started running as of the enactment date of Law 1581 for existing databases to become compliant with the provisions of the law.

Secondary Regulation

The Colombian government is already working on a secondary regulation which is expected to be enacted within the next three months and which will develop many of the provisions included in Law 1581.

María Carolina Pardo Cuéllar is a Partner and Sandra Juliana Castillo Mora is an Associate with Baker & McKenzie Colombia S.A. They may be contacted at carolina.pardo@bakermckenzie.com and sandra.castillo@bakermckenzie.com.