The Colombian Constitutional Court has published the long awaited ruling C-748-2011 on the constitutionality of the most recent Bill of Law on the protection of personal data in Colombia. The Court announced the ruling on the Bill on October 6, 2011 but only published its content until this week.

The Bill of Law is aimed at establishing general provisions regarding the protection of personal information in Colombia. The new law to be enacted, will therefore regulate all those aspects of privacy rights in Colombia that are not related to the protection of personal data for purposes of credit ratings, which aspect is already covered by the existing Law 1266 of 2008.    For more information   

The text of the ruling is quite extensive and includes an analysis on the procedural aspects of the Bill of Law as well as a detailed reference to each on the articles of such legislative document. In October 2011, the Court highlighted the following aspects within the ruling:

  • Personal data that has been made available to the public must be protected and processed respecting all the rights of the data subjects.
  • Personal data of boys, girls and adolescents (minors under the age of 18) can be processed as long as their main interests and fundamental rights are protected and always taking into account the opinion of the minor. The law originally forbade any way of processing of this type of data.
  • Personal data subjects may revoke their consent at any time without authorization from the Data Protection Authority. The law originally provided that consent could only be revoked when the Data Protection Authority considered there was a violation of the laws on personal data protection.
  • It was clarified that the Data Protection Authority is autonomous and independent.
  • The Data Protection Authority may not finance itself from the funds gathered from the sanctions imposed for the violation of personal data protection laws.
  • Cross-border transfer of personal data to protect public interest can only be made in light of a legal demand and not out of need.
  • The faculty to the Colombian government of regulating the processing of personal data that requires special provisions was eliminated. The regulation must be made through laws regulating fundamental rights (ley estatutaria).
  • The articles related to the processing of personal data related to judicial background, intelligence and counter intelligence, were declared unconstitutional for procedural reasons. Therefore, they will be eliminated from the law.
  • In relation to the need to obtain prior and express consent from data subjects to gather and process personal data, the Court made it clear that tacit consent is not valid.

We highlight that the Bill of Law will return to Congress for the corresponding modifications ordered for the law after which will be enacted by the President of the Republic of Colombia and will become of law of the Republic. The publication of the ruling from the Court does not make the law to enter into force.