Bogotá DC, May 26, 2021. The Superintendence of Industry and Commerce, in its role as the national Data Protection Authority, issued a mandatory compliance order to the company WhatsApp LLC to implement measures in accordance with the Colombian standard regarding “Habeas Data” and due processing of personal data.
The decision was made through Resolution 29826 of May 2021, after determining that the Privacy Policy (PP) of WhatsApp LLC breaches the requirements of the Colombian regulation by 57.89%. In addition, it was established that said company does not comply with 75% of the requirements established in article 12 of Statutory Law 1581 of 2012.
The Superintendence of Industry and Commerce was able to establish that this company collects and processes personal data of at least thirty-nine (39) million monthly active users in Colombia. Additionally, the company uses "cookies" to collect or process Personal Data in the national territory. Therefore, Law 1581 of 2012 is applicable to WhatsApp LLC, as this company collects personal data through a tool that is installed on mobile devices and/or computers located in Colombia.
The SIC ordered the following to WhatsApp LLC:
- Create a Privacy Policy (PP) that meets all the requirements established by the Colombian regulations. Said PP must be made known to the Data subjects domiciled or resident in Colombian territory.
- Implement an appropriate, effective, and demonstrable mechanism or procedure so that, at the time of requesting Consent of Data subjects, they inform them in Spanish, in a clear, simple, and express manner everything that is ordered by article 12 of Statutory Law 1581 of 2012.
- WhatsApp LLC must keep proof of compliance with the provisions of said article and, when the Data subject requests it, deliver a copy of it.
- Register their Databases in the National Registry of Databases, administered by the Superintendence of Industry and Commerce, with respect to the data that they collect or process in the territory of the Republic of Colombia on Data subjects residing or domiciled in this country.
Additionally, WhatsApp LLC was EXHORTED to inform the Superintendence of Industry and Commerce of an email address to receive communications or notifications of administrative acts. The foregoing is very important to have an expedited communication channel with a view to immediately addressing those requirements or decisions that involve the protection of the human rights of millions of users of WhatsApp LLC services.
Failure to comply with these orders leads to administrative sanctioning investigations that can generate fines of up to 2,000 current legal minimum wages or the eventual suspension of WhatsApp LLC activities in Colombia.
Against the decision, reconsideration, and appeal procedures are allowed by law.