Colombia Delegation for Protection of Personal Data Publishes Guide for Buildings
The Delegation for the Protection of Personal Data of the Superintendence of Industry and Commerce of Colombia published the "Guide on the Treatment of Personal Data in Properties." The purpose of this document is to present suggestions to all those who process personal data in residential, commercial or mixed-use buildings or complexes, which are subject to the horizontal property regime.
The guide emphasizes that it is important to have special guidelines for the collection of fingerprints, health-related data, photos and even video recordings since this must comply with the orders of Article 6 of Decree 1377 of 2013. This type of information is considered sensitive data, which must be handled with special care and diligence in any activity carried out with it.
In relation to the possibility of processing personal data of children, buildings or residential complex owners and managers must remember that children enjoy special protection and that authorization for the processing of their data must be granted by their legal representative. The processing in these cases must respond to and respect the best interests of the children and must also ensure respect for their fundamental rights.
Additionally, when the building or residential complex hires another company or third party, which will be considered as the processor, to carry out surveillance and security activities or any other type of activity, it is recommended that the third party is required to comply with its personal data processing policy. Therefore, in the agreements for the provision of services, obligations to be fulfilled by these third parties in relation to the processing of personal data must be agreed upon. It is advisable to agree on clauses that require the third party to comply with the personal data processing policies of the complexes or buildings, and to guarantee the security and confidentiality of the personal data, etc.
The entity also recommends that privacy notices be posted in easily visible places and that notices be used to inform people that they are being videotaped. These notices should be easily visible, legible and understandable and should be placed in doorways, elevators, garages, and all other places where cameras or surveillance mechanisms are used.
Finally, it is recommended that the buildings or complexes train all those who have access to personal data not to provide or allow access to this information to third parties not authorized by the owners of the information. Likewise, to guarantee the confidentiality of the data, it is important not to send massive electronic communications that allow the recipients to know information about other people; in the same way, these messages should only be sent to those who have given previous, express and informed authorization for this purpose.
We remind you that all buildings and complexes must carry out a full review of the obligations imposed on them by Law 1581 of 2012 and Decree 1377 of 2013 and take special care with the sensitive personal data they process in the course of their activity. Holland & Knight invites its clients who have doubts or concerns about the implications of the guide or the application of the legislation to contact us and receive complete, timely and appropriate advice.
Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.