Privacy espresso seriesResourcesAugust 18, 2022Underage datasubjects privacy laws in Colombia

In this privacyespresso, we discover with Valentina Soto Franco from the law firm Vanegas Morales Consultores the Colombian legal framework for the processing of underage data subjects’ data.

In general, the main regulatory points to keep in mind are that:

1. consent must be obtained before the start of the processing, or at the latest, at the moment of the data collection
2. consent must be free, express, informed and granted by underage data subject’s legal representatives
3. there is a Constitutional provision establishing that minors’ rights and best interests must be protected and prioritised in any decisions or acts affecting them

Considering this, initially, the Colombian law, General Data Protection Law (Art. 7 Law 1581 of 2012), established that the processing of underage data subject’s personal information was forbidden, except for public data. However, such a prohibition was soon perceived as an unnecessary restriction. Therefore, the Court clarified that the processing of data of underage data subjects is allowed if:

1. the principles applicable to the processing of personal data are respected, 
2. the purposes pursued with the processing benefit the minor
3. the underage data subject’s opinion on the processing is taken into account proportionally to their age

However a problem still remains, as underage data subjects cannot validly provide their legal consent, and in fact, the Colombian Data Protection Authority has been very strict in requiring consent directly from minors’ legal representatives. The only exception is for minors ranging from 14 to 18 years old as they are considered mature enough to provide valid consent. Nevertheless, this exception must be examined on a case-by-case basis and carefully applied.

Given all this, the Vanegas Morales Consultores’ advice to clients is to:

1. go by the general rule and establish procedures to directly request consent from the minor’s legal representatives
2. when the clients range from 14 to 18 years old, companies may opt for requesting consent directly from them but must be very careful not to use the information for non-essential purposes.

According to Valentina, in general, the key is to create strategies that creatively apply the law and facilitate processes for consumers and data subjects.