Due to the medical and sanitary urgency in the country, the Superintendency of Industry and Commerce (SIC), through the external memorandum 001 of March 23rd of 2020, authorized the cellular operators and the Industry Association of Colombia (ASOMOVIL) to provide the data necessary to attend, prevent, treat and control the propagation of COVID-19 and mitigate its effects, to the National Planning Department and other government institutions.
The SIC clarified that Article 10 is fully applicable, as it mentions that the authorization of the data owners is not required in the case of “(…) C) Medical or health emergencies; (…)”
Following the same line, Article 13 of the Law 1581 of 2012, allows the delivery of this data to the Authorities for the fulfillment of their functions: “(…) B) To public or administrative bodies in the exercise of their statutory functions or by order of a court; (…)”
This external memorandum also has a specific provision regarding the circulation of information (its recollection, use, and circulation), indicating that it must comply with the principles of security, confidentiality, and restricted circulation.
For example, Decree 458 of 2020 establishes the creation of a master database in the custody of the National Planning Department, which promotes the circulation of information as a necessary measure since it is required to reach the most vulnerable populations; thus, public entities in the exercise of their functions may legitimately request and obtain information from individuals or any person who might have such information.
While these entities are required to comply with the principles of confidentiality, security, and restricted circulation, they are also required to comply with all the duties regarding the protection of personal data. This creates a commitment for public entities, which have to implement stronger protocols that allow them to guarantee that the information that they are receiving will be stored in an organized manner and used according to the purposes, establishing conservation times and efficient ways for the exercise of rights by the Data Owner.
VMC suggests
The generation or reinforcement of internal processes of both public and private entities that allow them to demonstrate their diligence, generating the necessary traceability, in order to know who, and how the required information is being shared within these times of pandemic.
It is not enough to collect the data; we need to develop better ways to inform citizens so that the data treatments that are needed won’t take them by surprise.
Recently, in the beginning of June the SIC informed regarding the requirements of information made by the Mayors of Medellín, Bogotá and Cali, aiming to validate that they are complying with the obligations established with Law 1581, specially the accountability principle.
Due to the fact that this is an ongoing matter of interest, we will keep updating you on every important event that happens. For more information, check the news on The SIC webpage (Available in Spanish only).