On July 15, 2022, the Superintendence of Industry and Commerce, in its role as authority in the protection of personal data, issued External Circular No. 006 of 2022, by which it issues a series of instructions to both for Data Controllers and Processors regarding the use of technologies such as “predictive dialers”, “robocalls”, “nuisance calls” and/or artificial intelligence in connection with data processing for advertising, marketing and commercial prospecting purposes. This, with the aim of safeguarding the application of the regulations on the processing of personal data in the procedures and technologies used to collect, use or process this information because, although Colombian law authorizes the use of technologies to process data for these purposes, at the same time, it requires that the processing be carried out within the guidelines of the legal system and in compliance with the rights of the data subjects.
In this sense, the Superintendence gives 6 instructions:
- Comply with data processing regulations and safeguard the fundamental right of habeas data.
- Verify that the personal data was obtained lawfully and is able to demonstrate proof of authorization. This implies that the data controller must have obtained the prior, express, informed and sufficient authorization of the data subject, allowing its processing for marketing and advertising purposes; and that the data controller must verify that it is authorized to receive and process the information for these purposes.
- Do not contact people who no longer wish to receive advertising and delete their contact details at the request of Data Subjects. To this end, mechanisms must be put in place so that Data Subjects can request the deletion of their data or revoke the authorization.
- Establish effective mechanisms so that data subjects can exercise their rights to rectify and update data, as well as file complaints and claims. For this purpose, easily identifiable channels (link, e-mail, telephone) will be presented to the Data Subject, even in the event of sending advertising by SMS.
- Respond in a timely and appropriate manner to requests or complaints from data subjects regarding their personal data, in accordance with Articles 14 and 15 of Law 1581 of 2012.
- Do not contact people on days or at times that violate their “right to peace”.
Finally, the Superintendency emphasizes the need to implement constant control and verification mechanisms – internal and external audits – as well as to strengthen training activities for collaborators or persons involved in the processing of personal data, so that they always respect and guarantee the rights of individuals regarding the processing of their personal data.