COLOMBIA Trends and Developments Contributed by: Maria Carolina Pardo and Carlos Ignacio Arboleda, Baker McKenzie
ments of local regulations (Laws 1581 of 2012 and Decree 1377 of 2013); • prepare a Spanish version of the privacy policy and consent form for data subjects in Colombia; and • register databases in the national database registry ( registro nacional de bases de datos RNBD) of the SIC, an obligation applicable to any company that processes personal data in Colombia and has total assets in excess of approximately USD1 million. Administrative orders are the preliminary step prior to the launch of a formal investigation. These orders are aimed at providing the par - ties with an opportunity to ensure compliance with local regulations before the enforcement of a sanction. Although there is no publicly avail - able data on the state of compliance with these administrative orders, there has been no further investigation of – and no fines or other sanctions imposed on – the foreign entities involved. While the principles of Colombian data protec - tion law are very straightforward, there are cer - tain nuances that make compliance in Colombia somewhat of a hurdle. For instance, Colombia is a consent-based jurisdiction where “legitimate interest” is not grounds for personal data pro - cessing. Thus, foreign entities that process per - sonal data based on the General Data Protection Regulation (GDPR) and rely on legitimate interest have to modify consent forms and policies to include Colombia-specific terms, or entire sec - tions, to mitigate risks. Modification of the consumer protection statute Recently enacted Law 2439 of 2024 modifies the consumer protection statute (Law 1480 of 2011) on certain matters specifically related to
e-commerce. The main changes included in the statute are as follows. • When making purchases online, consumers have a unilateral right of withdrawal, which implies that sellers must fully refund the pur - chase. The term for the refund was cut in half, from 30 to 15 days, as of the date on which the consumer returns the product and notifies the seller of the withdrawal. • The seller must inform consumers of the time required for the shipping and delivery of prod - ucts. If no time is specified, the law provides for a maximum of 30 business days. Failure to deliver within the specified or default time period triggers a full refund obligation for the consumer. • “Contact portal” is newly defined as “any digital platform owned by individuals or com - panies that serves as the contact point for consumers and sellers to directly engage in contracts”. This definition follows a series of decisions whereby the SIC differentiated the responsibility of e-commerce platforms and contact portals. The latter, as now defined in the statute, are platforms that serve exclu - sively as marketplaces, where the terms of the purchase are defined directly between the seller and the consumer, with the platform having no control or influence over them. E-commerce platforms, on the other hand, have control or influence over the sale (eg, by setting minimum prices, mandatory discounts and the terms of purchase). Contact portals have not been held by the SIC as joint and severally liable with the seller in cases of con - sumer protection actions, unlike e-commerce platforms. Despite the inclusion of a definition of “contact portal” in the statute, the matter of liability was not addressed. • Fees and charges applicable for the use of technological features or applications in
52
CHAMBERS.COM
Powered by FlippingBook