ColombiaLey 1581 de 2012, Supervisory Authority and Sanctions
Ley 1581 de 2012, arts. 19-24 (Autoridad y Sanciones)
In force since .
An enforcement supervision rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Superintendencia de Industria y Comercio to investigate a violation on its own initiative or on complaint and to order the measures needed to make the habeas data right effective, including access, rectification, updating or deletion of the data at issue.
- Expect the Superintendencia de Industria y Comercio to temporarily block your processing of a data subject's information where the evidence shows a real risk to their fundamental rights, until it reaches a final decision.
- Comply with an administrative fine of up to 2,000 current monthly legal minimum wages, a suspension of your processing activity for up to six months, or the immediate and permanent closure of an operation involving sensitive data, imposed by the Superintendencia de Industria y Comercio for violating this law; these sanctions apply only to private parties, and a public authority's violation goes to the Procuraduria General de la Nacion instead.
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Superintendencia de Industria y Comercio (Delegatura para la Proteccion de Datos Personales)
What it makes you log
Logging duty
Articles 19 to 24 name the Superintendencia de Industria y Comercio as the data protection authority, list its functions, set the sanctions and the criteria for grading them. Article 21(f) lets it ask controllers and processors for the information it needs to do its work, and article 21(b) lets it investigate on its own initiative or on complaint. Those are powers to demand information with no record named, so the row records no logging duty and treats the power as an on-request check by the regulator. The articles cited here contain no scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Article 19 designates the Superintendencia de Industria y Comercio, acting through its Delegatura para la Proteccion de Datos Personales, as the authority that oversees compliance with this law's principles, rights, guarantees and procedures.
Article 21 empowers the Superintendencia to investigate a violation on its own initiative or on complaint and order the measures needed to make the habeas data right effective, temporarily block a controller's processing where the evidence shows a real risk to a data subject's fundamental rights, promote and publicize data subjects' rights, instruct controllers and processors on adapting their operations to this law, issue the declaration of conformity for an international transfer, and administer the National Public Registry of Databases.
Article 22 requires the Superintendencia, once it establishes a violation, to apply the Codigo Contencioso Administrativo for anything this law does not itself regulate, and the sanctions this law provides are purely administrative, since it creates no criminal offense.
Article 23 lets the Superintendencia impose a fine of up to 2,000 current monthly legal minimum wages, suspend the processing activity for up to six months, or order the immediate and permanent closure of an operation that involves sensitive data, reserving these sanctions for private parties and referring a public authority's violation to the Procuraduria General de la Nacion instead.
Article 24 grades a sanction by the extent of the harm or danger, the economic benefit the infringer or a third party obtained, repeat infringement, resistance or obstruction of the investigation, defiance of the Superintendencia's orders, and the infringer's own acknowledgment of the violation before the sanction is imposed.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .