The Colombia data protection authority (SIC) published its decision in resolution number 12395 of 2024, as issued on March 21, 2024, in which it imposed a fine of COP 35,568,848 million (approx. $8,620) on EMERMEDICA SA for violations of Statutory Law 1581 of 2012 (October 17), which Issues General Provisions for the Protection of Personal Data (the Data Protection Law) following a complaint.

Background to the decision

A complaint was filed after EMERMEDICA SA failed to respond to a request to delete personal data so that the complainant could stop receiving commercial text messages and calls. EMERMEDICA SA also did not guarantee the complainant the exercise of their fundamental right to have personal data deleted on time.

Findings of the SIC

The SIC stated that violations of Articles 4(e), 14, 15, and 17(j) of the Data Protection Law occurred when EMERMEDICA SA failed to respond to the complainant's request to delete personal data, failed to notify the complainant that their request was incomplete, and failed to notify the complainant that there was a delay in responding to the request. Further, the SIC stated that violations of Article 17(a) of the Data Protection Law occurred when the data subject was not granted the full exercise of the right of habeas data which grants the owner of the personal data the right to access, correct, add, update, or delete information. Lastly, the SIC mentioned that a violation of Article 8 of the Data Protection Law occurred when EMERMEDICA SA failed to delete the personal data on time.

Outcomes

As a result, a sanction of COP 35,568,848 million (approx. $8,620) was imposed, to be paid within five business days following the execution of the resolution. In addition, EMERMEDICA SA must communicate the decision to the complainant.

You can read the resolution, only available in Spanish, here.