ColombiaSuperintendencia Circular on AI and Personal Data
SIC Circular Externa 002 de 2024 instrucciones I, II, VIII-IX (Lineamientos sobre Tratamiento de Datos en Sistemas de IA), 21 de agosto de 2024
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, DPIA, Governance, Security
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Before collecting personal data from the internet to develop, train, test or deploy an artificial intelligence system, obtain the data subject's prior, express and informed authorization; a datum being accessible online does not make it a public datum exempt from that requirement.NIST Privacy FrameworkCT.PO-P1
- Weigh whether processing personal data in an artificial intelligence system is suitable to the goal pursued, necessary because no less intrusive measure achieves it equally well, reasonable because it serves a constitutional purpose, and proportionate because its benefits are not outweighed by the harm to the right to data protection.NIST Privacy FrameworkID.RA-P4
- Where you cannot be certain an artificial intelligence system's processing will not cause serious, irreversible harm, refrain from that processing or adopt precautionary measures, and adapt your risk management systems to identify, measure, control and monitor the situations that could affect your compliance with personal data protection rules.NIST Privacy FrameworkID.RA-P5NIST Privacy FrameworkGV.RM-P1
- Complete and document a privacy impact assessment before an artificial intelligence system likely to pose a high risk to data subjects processes their personal data, covering the processing operations, a risk evaluation, and the measures planned to prevent the risks identified.NIST Privacy FrameworkID.RA-P4
- Only process truthful, complete, exact, updated, verifiable and understandable personal data in an artificial intelligence system, and do not process partial, incomplete, fragmented or misleading personal data.NIST Privacy FrameworkCT.PO-P2
- Apply privacy by design and by default, including techniques such as differential privacy, so that data used to train an artificial intelligence system does not allow the person who provided it to be identified.NIST Privacy FrameworkCT.DP-P2
- Adopt technological, human, administrative, physical and contractual security measures to prevent unauthorized access to, manipulation, destruction, or unauthorized use or circulation of personal data processed in an artificial intelligence system, and keep those measures auditable by the authorities.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated and documented.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
1 more
- MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.RA-P5Risk responses are identified, prioritized, and implemented.
- GV.RM-P1Risk management processes are established, managed, and agreed to by organizational stakeholders.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DP-P2Data are processed to limit the identification of individuals (e.g., de-identification privacy techniques, tokenization).
1 more
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
2 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
Before designing and developing an artificial intelligence system likely to pose a high risk to data subjects, the controller must carry out and document a privacy impact study that describes the processing operations, evaluates the specific risks to the rights and freedoms of data subjects, and sets out the measures planned against them. Instruction VIII also requires the security measures to be auditable by the authorities. The text sets no retention period.
- Kind
- Explicit
- As of
- Provision
- The privacy impact study required before a high-risk artificial intelligence system (the paragraph after Instruction II), and the last sentence of Instruction VIII
- Trigger
- high_risk_systems
- personal_data_processing
What this law does
The SIC's Circular Externa No. 002 de 2024 instructs every data controller and processor subject to Ley 1581 de 2012 and Ley 1266 de 2008 on how those technology neutral statutes apply to developing, deploying, or using an artificial intelligence system that processes personal data.
Instruction I requires that processing to satisfy a four factor weighing test: the processing must be suited to achieve its stated goal, no less intrusive measure must achieve that goal as effectively, the goal itself must be a constitutional one, and the benefit to that goal must not be outweighed by the harm the processing does to the right to data protection.
Instruction II requires an administrator of personal data to refrain from processing, or to adopt precautionary measures, wherever it cannot be certain that processing will not cause serious and irreversible harm, and to adapt its risk management systems to identify, measure, control and monitor the situations that could affect its compliance with personal data protection rules.
The circular next requires a documented privacy impact assessment, covering the processing operations, a specific evaluation of the risks to data subjects' rights and freedoms, and the measures planned to prevent those risks, before an artificial intelligence system likely to pose a high risk to data subjects processes their personal data, requires that data used in an artificial intelligence system be truthful, complete, exact, updated, verifiable and understandable, and requires privacy by design and by default through mathematical techniques such as differential privacy, so that training data cannot identify the person who provided it.
Instruction VIII requires technological, human, administrative, physical and contractual measures against unauthorized access to personal data, its manipulation or destruction, its misuse, and its unauthorized circulation, and requires those security measures to stay auditable by the authorities.
Instruction IX states that personal data being accessible on the internet does not make it data of a public nature, so a controller that collects personal, semiprivate, or sensitive data online is not thereby entitled to treat it for an artificial intelligence system's purposes without the data subject's prior, express and informed authorization.
When LexLint raises it
When your app profile says your app trains models or processes personal data.
Back to the example · Lint your app
Page updated .