The processing of personal data is understood as the activity of collecting, storing, using, circulating, or deleting information, carried out by natural or legal persons, whether public or private; such activity may only be exercised with the prior, express, and informed consent of the data subject.
As the authority responsible for inspecting, supervising, and controlling the processing of personal data, the Superintendence of Industry and Commerce (SIC), with the aim of safeguarding the constitutional right of all individuals to know, update, and rectify information collected about them in databases and all types of files, has imposed sanctions exceeding $21 billion due to companies breaching the rules established by Law 1581 of 2012.
The above reflects that the SIC has been developing policies to ensure that the protection of personal data processing respects the principles, rights, guarantees, and procedures provided by law. An example of this is the case of LINIO COLOMBIA S.A.S, in which a citizen registered on the website to purchase a product and indicated that he accepted receiving advertising offered by the company to his email. However, he stated that he never accepted receiving advertising via SMS (text message to his cell phone).
Thus, the citizen, via email sent to the company's customer service, requested that his cell phone number be removed from its SMS advertising service and additionally demanded proof of his authorization. However, the company ignored such request. For that reason, the data subject filed the respective complaint with the SIC, which conducted the corresponding investigations into the case and, through Resolution No. 85654 of December 13, 2016, imposed a pecuniary sanction on LINIO COLOMBIA S.A.S in the amount of 350 minimum wages, equivalent to two hundred forty-one million three hundred nine thousand two hundred fifty pesos ($241,309,250).
As can be seen, companies must take into account that any instrument used for the storage and use of personal data requires prior consent from the data subject, since the lack of authorization for the processing of personal data and the failure to inform the purpose of its collection constitutes a violation of individuals' rights to know the information collected about them, to include new data in order to provide a complete picture of the data subject, to update the information so that it matches reality, and to exclude information from a database due to its improper use or by the mere will of the data subject.
In this regard, companies that handle, store, and manage personal data must carry out the respective registration in the National Database Registry (RNBD) and create policies aimed at the protection and management of personal data in accordance with the legal framework.
It should be noted that for natural or legal persons, whether private or public, that omit or violate the rules of Law 1581 of 2012 and its regulatory decrees, the SIC, in the exercise of its functions, may impose the following sanctions:
"a) Fines of a personal and institutional nature up to the equivalent of two thousand (2,000) monthly legal minimum wages in effect at the time of imposing the sanction. Fines may be successive while the breach that caused them persists;
b) Suspension of activities related to Processing for up to six (6) months. The suspension order shall indicate the corrective measures to be adopted;
c) Temporary closure of operations related to Processing once the suspension period has elapsed without the corrective measures ordered by the Superintendence of Industry and Commerce having been adopted;
d) Immediate and definitive closure of the operation involving the Processing of sensitive data"[1]
If you have any questions or concerns about this topic, please contact us.
[1] Statutory Law 1581 of 2012. Article 23. By which general provisions for the protection of personal data are issued. October 17, 2012.