Intellectual Property Law

Data Protection in Colombia

By Martha L. Arias

On May 2008, the Colombian Telecommunication Commission -Comisión de Regulación de Telecomunicaciones- offered a synopsis about current Colombian data protection regulations and pending legislation on this issue. The Colombian Constitution and various national decrees and resolutions are currently applied to the protection of personal data, or "habeas data" as most Latin American countries refer to this topic. Additionally, two important bills on data protection are pending approval in the Colombian Congress. 

Law

According to the synopsis offered by the Colombian Telecommunication Commission (CTC), the Colombian Constitution and several national decrees and resolutions regulate data protection in Colombia.   Article 15 of the Colombian Constitution confers on individuals the fundamental right to know, update, and correct their personal information found in databases and records kept by government agencies and private entities.  Three individual rights derive from this article:

(1) the right to protect personal data from illegal use or handling by data collectors or public and private record keepers;

(2) the right to know, update, and fix personal data found in databases and records held by public and private entities. According to a sentence by the Colombian Constitutional Court (T-462/97), this right can be invoked by both private persons and legal entities; and

(3) the data subject right to access and control personal data held by private or public entities.

In addition to article 15, other constitutional articles complement the regulation of personal data in Colombia.  Article 20 provides the right to receive and provide information, including personal information; article 15 guarantees individuals the right to a "good name" (reputation); article 21 guarantees the right to personal honor; and article 15 guarantees the right to privacy. 

Additionally, Resolution No. 3384 (1975) ratified the United Nations Assembly's decision in which Colombia committed to the use of technological and scientific advances for peace and humanitarian purposes. The CTC states that two legal principles emerged from this Resolution: (1) the Colombian government recognized that scientific and technology advances are essential for the evolution of society; yet, those advances can also post risks to individual liberties and human rights that must be addressed by legislative measures; (2) the Colombian government declared the need to adopt legislative and other measures to address these risks.    

Jurisprudence

Case law (or "jurisprudence" as called in Civil Law Systems) developed by the Colombian Constitutional Court (CCC) has provided guidance on the interpretation of Article 15. For instance, (1) the data subject is the "holder' and "owner" of its personal data (T-416 of 1992); (2) regarding authorizations given by the data subject to include its personal information in databases, the CCC has determined that this authorization must be voluntary, previous, and specifically stated (T-552 of 1997, T-527 of 2000, and T-002 of 2003); (3) in terms of the right to access personal information, the CCC has held that the holder and owner of the personal information has the right to access, update, and rectify its data (T-303 of 1998, T-309 of 1999, and T- 321 of 2000); (4) in terms of accuracy and veracity of information, the CCC stated that article 20 of the Colombian Constitutions grants the right to receive and provide accurate and impartial information; this information includes data subjects' personal data (T-729 of 2002, T-615 of 1995, T-176 of 1995, and T-060 of 2003); (5) on the purpose and relevancy of collection of personal data, the CCC has held that personal data must be collected for a legal purpose (T-729 of 2002, and T-307 of 1999); (6) regarding expiration or forgotten data, the CCC held that individuals have the right to request deletion of negative personal information that has expired   (T-414 of 1992, T-185 of 2003, T-303 of 1998, and T-814 of 2002); (7) it is illegal to collect sensitive information when this may conduce to discriminatory treatment (T-307 of 1999); data collectors must handle personal data without violating individuals' fundamental rights  (T-512 of 1992, SU-056 of 1995, and T-729 of 2002); (8) data subjects have a constitutional right to control and demand appropriate use of personal data (T-310 of 2002, T-676 of 2003, T-176 of 1995, and T-552 of 1997); and (9) it is not permissible to collect personal data without a  purpose expressly authorized by law (C-185 de 2003). 

Pending Bills

The CTC's report informed that two data protection bills are currently pending approval in the Colombian Congress.  The first bill aims to specifically regulate personal data protection in Colombia and establish rules for the use and management of these databases, including databases with financial, commercial, and credit information (Bill No. 27/06 Senate ? 221/07 House of Representatives (05/06)).  The other pending bill will regulate the information society and related telecommunication features in Colombia (bill No. 112/2007) and create the National Spectrum Agency.       

Full post as published by IBLS Internet Law Blog on September 24, 2008 (boomark / email).