Personal Data Protection in Colombia is defined by the Superintendence of Industry and Commerce (hereinafter SIC) as follows: “The Law that recognizes and protects the right of all individuals to know, update, and rectify information that has been collected about them in databases or files that may be processed by public or private entities.” (Superintendence of Industry and Commerce, n.d.)
Now, taking into account the definition of the Personal Data Protection Law, we must necessarily explain what Personal Data means for a better understanding of the subject: Personal Data is understood as information associated with a person that allows their identification, such as identification document, place of birth, marital status, academic, work, and/or professional background. Additionally, it also covers more sensitive information such as medical history.
It should be added to the previous point that Personal Data is collected in our daily lives when filling out various forms, for example, when applying for credit at a financial institution, where we must fill out forms with our personal information, or when making a purchase where we must provide our identification number on the sales invoice.
Taking into account the above definitions, we will proceed to begin the topic of Personal Data Protection, which will be focused within Colombian regulations, considering the different international standards to determine countries that have an adequate level of Personal Data Protection, which will be addressed as follows:
Existence of Rules Applicable to Data Processing
As regulations, Law 1587 of 2012, which issues general provisions for the protection of personal data. Its Article 1 sets forth the Purpose, stating that it aims to develop the constitutional right of all individuals to know, update, and rectify information collected about them in databases or files, as well as the other rights, freedoms, and constitutional guarantees referred to in Article 15 of the Political Constitution.
It is of great importance to understand that the protection of Personal Data is elevated to a fundamental right, since it is of vital importance for the State to protect and allow citizens to enjoy this right without any negative imposition.
The Normative Enshrinement of Principles Applicable to the Matter
Regarding the principles applicable to the matter, we can find Article 4 of the same law, which develops the guiding principles that will lead to the efficient, effective, and harmonious application of the rule:
a) Principle of legality in data processing.
b) Principle of freedom.
c) Principle of truthfulness or quality.
d) Principle of transparency.
e) Principle of purpose.
f) Principle of restricted access and circulation.
g) Principle of security.
h) Principle of confidentiality.
The Normative Enshrinement of Data Subjects' Rights
Continuing along the same line, Article 8 of the law we are working with sets forth the regulations regarding the rights of Personal Data subjects, among others:
a) To know, update, and rectify their personal data with the data controllers or processors.
b) To be informed by the data controller or processor, upon prior request, about the use that has been given to their personal data.
d) To file complaints with the Superintendence of Industry and Commerce for violations of the provisions of this law and other rules that modify, add, or supplement it.
The Normative Enshrinement of Duties of Controllers and Processors
In the same manner as the previous point, Articles 17 and 18 of this law set forth the duties of the controllers and processors of Personal Data.
The Existence of Judicial and Administrative Means and Avenues to Ensure the Effective Protection of Data Subjects' Rights and to Enforce Compliance with the Law
As a protection mechanism to ensure the effective protection of rights and subjects for compliance with this law, two tools are provided: the right to petition and the tutela action. The former serves as the regular channel, since one can formally request, materialized in a right to petition (Law 1755 of 2015), the fulfillment of individual rights. And subsidiarily, after exhausting other avenues to request protection of the right, the tutela action can be used when a fundamental right is being violated.
The Existence of Public Authorities Responsible for Supervision of the Matter
The competent authority for the processing of Personal Data, its supervision, and protection lies with the Superintendence of Industry and Commerce.
All these points set forth above are standards that other countries must enshrine to make the task of transferring Personal Data easier, without violating the constitutional right of the individual. However, there is the possibility that certain countries, except for Germany, Costa Rica, the USA, France, Italy, Mexico, and Peru, which have been classified by the SIC as countries with an adequate level, may not have good regulatory development on Personal Data protection. That is why, in order to prevent and avoid any defect and violation of the rights of data subjects, this law provides, in its Article 26, the express prohibition of transferring data to third countries that do not have an adequate level of protection.
In conclusion, the importance for Colombia of the proper treatment of Personal Data of data subjects is evident, since they are of vital importance not only for the development of the individual as such, but also of great significance for the continued contribution to the socio-economic growth of the State.
Likewise, the legislator, in order to protect the individual data subject, has elevated the right to a constitutional rank, since it is linked to the right to personal and family privacy, given that, as explained at the beginning of this text, personal data also covers issues related to health, political and sexual ideology; therefore, mishandling of these could violate fundamental rights.