Colombian Data Protection Authority Requires Database Registration

The SIC issued suggested time periods for data controllers incorporated in Colombia to register. The time periods are based on the last two digits of data controllers’ Tax Identification Numbers (“TINs”) without the confirmation numbers:

• 00-24:  November 9, 2015 – February 8, 2016

• 25-49:  February 9, 2016 – May 10, 2016

• 50-74:  May 6, 2016 – August 8, 2016

• 75-99:  August 9, 2016 – November 8, 2016

Databases created after November 8, 2016, must be registered within two (2) months of the date of creation.

Registration involves reporting the following:

1. Name and purpose of the database.

2. Identification, location, and contact information of the data controller.

3. Identification, location, and contact information of any Data Processors involved in processing the database.

4. The channels through which data subjects may exercise their rights.

5. Form of processing of the database (manual and/or automatized).

6. Copy of the Data Protection/Privacy Policy.

7. The types of information stored in the database, classified into the categories and subcategories defined in the Registry.

8. Information security measures.

9. Source of the personal data. Data controllers must report if the personal data contained in databases was obtained directly from data subjects or obtained from third parties. And data controllers must report that they have obtained the prior, express and informed consent from data subjects or are processing personal data pursuant to an exception under Law 1581 of 2012.

10. International transfers of personal data processed in the database (from either a data controller or a data processor to a data controller).

11. International transmissions of personal data performed (from a data controller to a data processor).

12. Information about assignments or domestic transfers of personal data.

Registration must be performed online via the following link: http://rnbd.sic.gov.co/sisi/login. The “Registry User Manual” provides additional information about how to register and the information that data controllers must provide.

After registration, data controllers are required to update information submitted to the Registry:

1. if there is a substantial modification of the information submitted (within the first 10-business days of each month);

2. if there is a modification of the information provided (annually between January 2 and March 31);

3. if there are any claims filed by data subjects (biannually within the first 15-business days of February and August). The first report should be made in February 2017; and

4. if there is a breach of security or a compromise of information contained in the database (within 15-business days).

The failure to register or update registration information would constitute a violation of Colombia’s Data Protection Laws. Such a violation could result in administrative sanctions, including (i) fines of up to COP$1,288,000,000 (approx. US$ 450,000) (for 2015), (ii) suspension of the activities related to processing of personal data for up to six (6) months in order to implement corrective measures, (iii) temporary closing of operations or activities related to processing of personal data if corrective measures are not implemented, or (iv) definitive closing and/or termination of operations or activities related to processing of personal data. We anticipate that the SIC will use the Registry as a benchmark for investigating and issuing sanctions related to breaches of the Data Protection Laws.

Ana María Calero Pinero, an associate with Brigard & Urrutia, a Colombian law firm, contributed to this article.

Authored by James Denvil.