Data protection and cybersecurity laws in Colombia

• Articles 15 and 20 of Colombia’s Constitution recognises the right to privacy and to data rectification as fundamental rights.
• Law Nº 1581 of 2012: Regulates data processing and databases.
• Law Nº 1266 of 2008: Regulates financial and credit data processing and databases. 
• Decree Nº 1377 of 2013: Partially regulates the dispositions stated in Law N° 1581 of 2008.
• Decree Nº 886 of 2014: Partially regulates the dispositions stated on Law N° 1581 of 2008.
• Decree Nº 2952 of 2010: Regulates the dispositions stated on Law Nº 1266 of 2008.
• Law Nº 1273 of 2009: Establishes the unlawful and unauthorised personal data processing as a crime and incorporates it into the Criminal Code.
• Decree N° 90 of 2018: Establishes the criteria for the mandatory registry of databases on the National Database Registry (NDR).
• Unique Circular from the Superintendence of Industry and Commerce: Title V specifically regulates different aspects regarding personal data protection such as data transfers, habeas data right, and the National Data Registry (NDR).
• External Circular Nº 005 of 2017 from the Superintendence of Industry and Commerce: Sets the standards for an adequate level of protection of any receiving country when it comes to international data transfers. Establishes the requirements for a country to obtain a declaration of conformity to carry out international transfers of personal data.

Superintendence of Industry and Commerce (SIC) - Data Protection Delegate Superintendent

There are no anticipated changes

Administrative sanctions:

The SIC has the power to apply any of the following sanctions:

• Fines, up to the equivalent COP 2,000 minimum monthly legal wages (USD 435,000).
• Temporary suspension (up to six months) or closure of activities related to the data processing.
• Immediate and definitive foreclosure of the operation involving the processing of sensitive data.

Criminal sanctions:

The Criminal Code states that anyone who, without authorisation, seeking personal or third-party gain, obtains, compiles, subtracts, offers, sells, exchanges, sends, purchases, intercepts, divulges, modifies or employs personal codes or data contained in databases or similar platforms, can be punished with:

•  48 to 96 months of prison
• And/or a fine of COP 1,000 minimum monthly wages (USD 28,400)

The processing of personal data requires the prior and informed authorisation of the Data Subject, which must be obtained by any means that can be later consulted. The Controller, when requesting the Data Subject’s authorisation, must inform him or her clearly and expressly of the following:

• The type of processing to which his/her personal data will be subject and its purpose.
• The optional nature of the answers to the questions asked, when these are about sensitive data or about the data of children and adolescents.
• The rights to which he/she is entitled as a Data Subject.
• The identification, address or electronic address and phone number of the Controller.

Regarding databases, those that store personal data and whose automated or manual processing is carried out by a natural or legal person (public or private), in Colombian territory or abroad, and that have total assets that exceed TVU 100,000, must be subject to registration in the NDR handled by the DPA.

Data Processors must comply with the following duties, regardless of the rest of the rules set forth in the Law and the others that may govern their activity:

• Guarantee to the Data Subject, at all times, the full and effective exercise of the habeas data right;
• Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorised or fraudulent access;
• In a timely manner, update, amend or delete data in the terms set forth in Law Nº. 1581 of 2012;
• Update the reported information by the Data Controller within five business days from when it was received;
• Process the consultations and claims made by the Data Subject in the terms indicated in Law Nº 1581 of 2012;
• Adopt an internal policy and procedure manual to ensure compliance with Law Nº 1581 of 2012 and, in particular, to respond to enquiries and complaints by the Data Subject;
• Register a “Claim in progress” tag in the database in the terms set by the Law Nº 1581 of 2012;
• Register an “Information in judicial discussion” tag in the database once the Processor is notified by the competent authority about any judicial processes related to the personal data;
• Refrain from circulating information that is being disputed by the Data Subject, and whose blocking has been ordered by the Superintendence of Industry and Commerce;
• Allow information access exclusively to people who should have access to it;
• Inform the Superintendence of Industry and Commerce when there are violations of security codes and risks regarding the administration of the Data Subject’s information;
• Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce;
• Comply with the obligations regarding data flows (transfer and transmission).

The following are rights granted to Data Subjects:

• To know, update and rectify personal data with the Data Controller or Processor. This right may be exercised in the event of partial, inaccurate, incomplete and/or misleading data; and data whose processing is expressly prohibited or has not been authorised;
• To request the proof of the authorisation granted to the Data Controller;
• To be informed by the Data Controller or Processor, upon request, on how his or her personal data has been used;
• To submit complaints before the Superintendence of Industry and Commerce regarding infringements and violations of data protection regulations;
• To revoke the authorisation and/or request suppression of the data when its processing does not respect constitutional principles or legal provisions. The revocation and/or suppression will proceed if the Superintendence of Industry and Commerce determines that the Data Controller or Processor has engaged in said conducts;
• To freely access the personal data that has been processed.

A third-party Processor may process personal data if it follows transmission instructions provided by the Controller. International transmission agreements should take place according to Decree Nº 1377 of 2013. International transmission may only be carried out with other countries authorised by the Superintendency of Industry and Commerce.

International data transfers are generally prohibited, unless the country in which the recipient Controller is located meets at least the same data protection standards (adequate level of protection) as the ones provided under Colombian laws. The transfer is also allowed in cases in which the Data Controller has obtained a transfer authorisation from the Data Subject, and in the following cases:

• exchange of medical data;
• bank and stock transfers;
• transfers agreed under international treaties to which Colombia is a party;
• necessary transfers for a contract between the Data Subject and Controller;
• implementation of pre-contractual measures;
• and transfers legally required in order to safeguard public interests.

The authorised countries for the international transfer of personal data are Australia, Austria, Belgium, Bulgaria, Cyprus, Costa Rica, Croatia, Denmark, Slovakia, Slovenia, Estonia, Spain, United States of America, Finland, France, Greece, Hungary, Ireland, Iceland, Germany, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Mexico, Norway, the Netherlands, Peru, Poland, Portugal, the UK, Czech Republic, Republic of Korea, Romania, Serbia, Sweden, and the countries the European Commission deems appropriately protected.

Colombian Laws on data protection do not require the appointment of a Data Protection Officer within organisations. However, companies must allocate a department or a person in charge of personal data matters in order to handle requests by Data Subjects. While the DPA’s Accountability Guide is not an obligatory publication, it includes a “minimum of compliance” that the Authority must consider in any inspection or investigation of a personal Data Controller or Processor.

Law Nº 1266 provides that Data Processors must implement security systems with technical safeguards to ensure the safety and accuracy of the data, and to prevent damage, loss, and unauthorised use of or access to the data. Law Nº 1581 of 2012, on the other hand, states that Data Controllers and Processors must guarantee that the personal data is being kept under strict security and confidentiality measures, that it will not be disclosed or modified and will be used for the approved purposes by the Data Subject. Data Processors and Controllers must therefore develop an internal policy and procedure manual to comply with data protection regulations.

Any data security breach, or any risk of one occurring must be notified by the Data Controller or Processor to the DPA.

eCommerce is currently regulated by Law 527 Nº of 1999. However, considering that an email address is personal data, any processing requires the authorisation of the Data Subject and must be done according to personal data protection laws (Law Nº 1581 of 2012).

Cookies could eventually form a database according to the legal definition from Law No. 1581 of 2012 when collecting personal data, taking into account the following characteristics: (i) when the data refers to exclusive and specific aspects of a person, ii) when the data allows the person to be identified; iii) when the data’s ownership resides exclusively on the Data Subject and iv) when the data’s processing is subject to special rules (principles) regarding its acquisition, administration and disclosure. The person responsible must adhere to the data protection regulations in Colombia (Law Nº 1581 of 2012). Taking this into account, the use of cookies must be allowed by the Data Subject through his/her prior and informed authorisation.

Severe.

• https://www.sic.gov.co/sites/default/files/normatividad/Ley_1266_de_2008_(Habeas_Data).pdf
• https://www.sic.gov.co/sites/default/files/normatividad/Ley_1581_2012.pdf
• https://www.sic.gov.co/sites/default/files/normatividad/082017/Circular_Externa_005_de_2017.pdf
• http://wsp.presidencia.gov.co/Normativa/Decretos/2013/Documents/JUNIO/27/DECRETO%201377%20DEL%2027%20DE%20JUNIO%20DE%202013.pdf
• http://es.presidencia.gov.co/normativa/normativa/DECRETO%2090%20DEL%2018%20ENERO%20DE%202018.pdf
• https://www.sic.gov.co/noticias/guia-para-la-implementacion-del-principio-de-responsabilidad-demostrada

• CONPES document Nº 3854, released on 11 April 2016, is the National Policy that is currently in force regarding Cybersecurity in Colombia; it constitutes the general standards for cybersecurity, cyberdefence and risk management measures;
• Law Nº 1928 of 2018: By which Colombia adheres to the Budapest Agreement on cybercrime signed in November 2001;
• Law Nº 1273 of 2009: Introduces specific legislation on cybercrime under Colombian criminal law;
• Resolution Nº 2710 of 2017 issued by the Ministry of Information Technologies and Communications: Established actions to adopt IPv6 protocol in order to avoid sharing IPv4 directions, and assign a unique IP per user to encourage cybersecurity.
• Resolution Nº 5050 of 2016 issued by the Communication Regulation Commission: Contains general instructions to guarantee network security and services integrity. It introduced the obligation to implement security models, using the ITU’s framework X.800 and technical measures. It reinforces inviolability of communications principle as well as data and information security principles, introducing the obligation of network and telecommunication service providers to inform customers about network security risks and secure fraud prevention.
• External Circular Nº 007 of 2018 issued by the Colombian Financial Superintendence: Imparts instructions related to the minimum requirements for cybersecurity risk management.

Draft Bill No. 339 of 2020: Cybercrime

The bill seeks to criminalise new cybercrimes that particularly affect minors, and introduce preventive actions.

Draft Bill No. 033 of 2019: Cryptocurrency

The bill seeks to establish new cybersecurity standards for cryptocurrency-related transactions, designating the Technology Ministry as watchdog.

Financial Superintendency: Draft resolution

Seeks to introduce new report protocols for cybersecurity incidents, and to implement new Traffic Light Protocols for data exchange.

• Network and IT systems:
  Law Nº 1341 of 2009 is the sectoral law for information technology and communication services. Network and information systems are regulated under that law, their definition is linked to the ITU’s concepts as mentioned on article 6 of the mentioned law. Communication services are defined as: “services that provide the ability to send / receive information in accordance with the conditions for the provision of such services previously agreed between a provider and a user”;
• Critical Information Infrastructure Operators:
  Critical Infrastructure is defined by official documents such as CONPES Nº 3701 of 2011, CONPES Nº 3854 of 2016, which also established rules for Critical Information Infrastructure Operators (“CIIO”);
• Cloud Computing Services:
  The guideline released by the Ministry named “Security and privacy of information” included controls and specific technologies, such as: i) PKI/PKOs; ii) data loss prevention by using methods like DRM, ZIP or Open PGP; iii). Data activity monitor, among others, in order to protect data storage in the cloud;
• Digital Service Providers.

• National Planning Department (NPD)
• Ministry of Information Technologies and Communications (MinTIC)
• Superintendence of Industry and Commerce
• Financial Superintendence

• Security Measures: Ministry of Information Technologies and Communications has established some security measures through the Digital Security Risk Management Model and the System for Information Security Management, which may resume as follows: i) organisational commitment; ii) identification of stakeholders and processes related to digital security management; iii) develop a risk management policy; iv) role definition and liability; v) resources for digital security risk management such as: budget, human resources and tools to control security. Under Data Protection Law and its Regulatory Decree 1377 of 2013 as well as the CONPES Nº 3854 of 2016, there are technical and organisational measures to manage data security risks. Decree Nº 1377 of 2013 introduces the obligation of the Controller and the Processor of personal data to adopt a “Personal data management programme”, an internal policy and procedure manual to guarantee DPL compliance and attention to queries and claims. The Guideline for implementation of Accountability Principle in personal data protection, released by the Superintendence of Industry and Commerce (“SIC”) developed some measures, such as the protocols for responding and managing data breaches and/or security incidents and risk management systems for personal data processing;
• Notification on Cybersecurity Incidents: There is not a mandatory duty for every party involved in reporting incidents to the National Government. But in the event of a cybersecurity incident, Colombian Cyber Emergency Response Group (ColCERT) has its own procedure to notify incidents. Cybercrimes and cybernetic incidents can be reported to ColCERT or to the Police Cybernetic Centre. If the incident is related to a personal data breach, there is an obligation to notify it to the Superintendence of Industry and Commerce;
• Registration: Data Protection Law that demands, under Article 17, that the Database Controller must register on the National Databases Registration (NDR) managed by the Superintendence of Industry of Commerce if it meets the criteria;
• Appointment of a Security Officer: The E-Government strategy for public entities introduced the mandatory System of Information Security Management, which includes the appointment of a security officer. The officer must plan, coordinate and manage information security processes; define control and follow up measures to quantify compliance in security; manage the development and implementation of policies, rules and directives and procedures of information security management; supervise security incidents and investigate security violations; among other functions.

Administrative sanctions:

The SIC has the power to apply any of the following sanctions:

• Fines, up to the equivalent of COP 2,000 minimum monthly legal wages (USD 435,000);
• Temporary suspension (up to six months) or closure of activities related to the data processing;
• Immediate and definitive foreclosure of the operation involving the processing of sensitive data.

The Financial Superintendency can also impose penalties on those who fail to comply with requirements established in External Circular Nº 052 of 2007.

Criminal sanctions:

The violation of Law No. 1273 of 2009 (Cybercrime regime) can cause:

• A penalty ranging from 36 to 96 months prison time
• A penalty ranging from 100 to 1,500 times the minimum wage (approximately UDD 28,430 to USD 426,400)

Others:

None

Yes.

ColCERT (Grupo de Respuesta a Emergencias Cibernéticas de Colombia). Its main purpose is to coordinate necessary actions to protect infrastructure from cybersecurity emergencies that may threaten or compromise national security.

Yes.

The Ministry of Information Technologies and Communications released the Digital Security Risk Management Model and the System for Information Security Management, which defines some technical measures that must be adopted by public entities although it is designed for all public and private entities.

Other rules that can relate to cybersecurity-specific matters are: Law Nº 527 of 1999 regarding eCommerce; Law Nº 594 of 2000 or General Archive Law; Law Nº 679 of 2001 and Law Nº 1336 of 2009, regarding child pornography and sexual exploitation; Law Decree Nº 019 of 2012 regarding entities authorised for digital certification; Decree Nº 1704 of 2012 regarding legal interception of communications; CRC Resolution Nº 3502 of 2011 about Net Neutrality; Decree Nº 2573 of 2014 about eGovernment; amongst others.

• https://colaboracion.dnp.gov.co/CDT/Conpes/Econ%C3%B3micos/3854.pdf
• http://www.colcert.gov.co/?q=contenido/pol%C3%ADtica-nacional-de-seguridad-digital
• http://www.secretariasenado.gov.co/senado/basedoc/ley_1922_2018.html
• http://www.secretariasenado.gov.co/senado/basedoc/ley_1273_2009.html
• https://www.crcom.gov.co/es/pagina/resolucion-crc-5050-de-2016