Colombia Update: COMMERCIAL CONTRACTS, LEGAL UPDATE, DATA PROTECTION AND PRIVACY

Colombia Update: COMMERCIAL CONTRACTS, LEGAL UPDATE, DATA PROTECTION AND PRIVACY

Law 2157 of 2021, Law of Clean Slate

Clean Slate Law

On October 29, 2021, Law 2157 of 2021 (the “Law”) was issued, under which Statutory Law 1266 of 2008, better known as the Habeas Data Law, was amended and added.

By means of the Law, the following relevant aspects of the Habeas Data Law were modified:

1.The term of permanence of the information will be twice the time of the default, and in any case of a maximum of four (4) years, counted from the date on which the overdue installments are paid or the obligation is extinguished.

2.The Act amended the amount of fines that can be imposed by the authorities. In this sense, the fines will be equated to those contained in the Statutory Law on Data Protection (Law 1581 of 2012), and they may be up to two thousand (2,000) minimum legal monthly wages in force (SMLMV) (for 2021 COP$1,817,052,000).

3.Additionally, users will be obliged to inform the owner, to the extent that he requires it, in writing the reasons why the credit was denied.

4.The new law establishes that the consultation of the information will be free at all times for the holder. Likewise, it establishes that the fact that a holder constantly consults their information may not affect their risk rating; and specifies that it will not be possible to consult the financial, credit information and in general the one protected by the aforementioned laws, for making labor decisions, since its only purpose is the analysis or calculation of credit risk.

On the other hand, with the issuance of the Law, the following aspects were added in terms of financial habeas data:

The negative data and those that refer to the time of default, type of collection, or refer to issues of non-compliance they will expire after the term of eight (8) years counted from the default. In this sense, once the term is fulfilled, the negative data must be deleted from the database. This obligation must be fulfilled by both operators and users and sources of information.

Likewise, the following obligations were added at the time of reporting the information:

If the obligation is less than fifteen percent (15%) of an SMLMV, the negative report can only be made once two communications have been sent on different days, at least twenty (20) days apart, to the owner of the data.

From the date, sources must report delinquent holders within a maximum period of 18 months after the default. After this period, the negative report could not be made.

In the event that the sources fail to comply with their obligation to send the communication to the owner (art. 12 Habeas Data Law), the negative report must be deleted, comply with the communication, and if the debt persists make the report again.

Additionally, the Law recognizes the principle of demonstrated responsibility in relation to compliance with it, and therefore operators, sources and users must be able to demonstrate that they have implemented the appropriate, effective and verifiable measures of the obligations established in the Law. The principle of proven responsibility will apply in the same sense as it applies in the data protection law (Law 1581 of 2012), and therefore its compliance will be verified in accordance with:

• The legal nature and size of the business;
• The nature of the data being processed;
• The type of treatment;
• The potential risk to the rights of the rightholder.
• In this sense, it will be necessary for operators, sources and users to guarantee:
• The existence of an administrative organization for the adoption and implementation of policies in accordance with the Law;
• Implementation tools, training and education programs to implement policies;
• Adoption of processes for the attention and response of petitions, queries and claims of the holders.

Thus, to the extent that your company is implementing the principle of demonstrated responsibility for compliance with Law 1581 of 2012, its adaptation to this Law will be much easier.

On the other hand, within the procedures of petitions, consultations and claims, special considerations were added for cases of impersonation, and silence. In this sense, claims for impersonation must be addressed by the source within ten (10) days of receipt of the information, collating it, and if true by modifying the report and adding a legend that says “Victim of Personal Falsehood”. Additionally, if the source considers it so, you can report the crime of fraud of which you may be a victim. In relation to the silence in the response to a request from a data subject, it has been clearly established that in the case of not responding in the applicable term (art. 16 Habeas Data Law), it will be understood that the request has been accepted and if it is not, the holder can request the Superintendency of Industry and Commerce or the Financial Superintendence to impose the fines established in the Law.

The Law established a transitional regime through which holders who have extinguished their obligations before the entry into force of the law and for up to twelve months after it benefit. The negative report removal benefit will apply depending on the following:

If the holders extinguish their obligations within twelve (12) months following the entry into force of the law, the negative information will remain in the data banks for six (6) months, and subsequently the information must be automatically deleted.

If the holders have extinguished their obligation prior to the entry into force of the Law and the negative data has already been in the data banks for at least six (6) months, the holder will be immediately withdrawn.

In the same way, if the holders extinguished their obligation object of report, but have not yet been in the database for at least six (6) months, said negative information will remain for the time it takes to complete the six (6) months, at which time the information will be deleted.

In any case, if the default is less than six (6) months, the negative information will remain for the time of the default, counted from the extinction of the obligation.

On the other hand, to the following holders, if they extinguish their obligation within twelve (12) months following the entry into force of this Law, the negative data will be immediately withdrawn:

• Small and medium-sized enterprises.
• Tourism sector.
• Small agricultural producers.
• Natural persons who exercise commercial or independent activities.
• Small producers in the agricultural sector, victims of the armed conflict and young people and rural women who have agricultural credit with Finagro.
• Debtors and co-debtors who have credit debts with Icetex.

We will be at your disposal to address any concerns you have in relation to the news of this Law.

By María Alejandra De Los Ríos & María Camila Hernández, LLOREDA CAMACHO & CO, Colombia, a Transatlantic Law International Affiliated Firm.  

For further information or for any assistance please contact colombia@transatlanticlaw.com 

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.