The draft bill that reforms the financial “habeas data” was approved in second debate

03 Jan The draft bill that reforms the financial “habeas data” was approved in second debate

Credit bureaus receive credit, financial, commercial and services personal data from different sources. These sources, in turn, collect such personal data from the information holders – the data subjects. Bureaus make personal information on data subjects – including records and antecedents – available for its users so the latter’s can assess, for example, credit risks derived from a potential commercial relationship with the data subject.  

The processing of this kind of personal data, called financial “habeas data”, was regulated by Law 1266 of 2008, which further developed article 15 of the Political Constitution. On 2 December, 2019, the Colombian Senate approved in second debate the draft bill of Law 62 of 2019, which would reform the currently enforceable legislation on financial “habeas data”. The draft bill would modify seven articles of Law 1266 of 2008, would add a new article on the obligations applicable to information sources and information operators and would establish a transitional regime for its implementation, which includes a kind of amnesty. 

From the draft bill that was approved by the Senate we can highlight the following four amendments: 1) the processing of the data subjects negative information; 2) rectifications on information requested by data subjects, which have been victims of the “personal misrepresentation” crime; 3) the term for which the negative information can be retained in databases; and 4) the establishment of “amnesties” on negative information. 

To begin with, the draft bill establishes a maximum period for the information source to report the data subjects negative information: 18 months from the date that an obligation becomes enforceable. In addition, the draft bill orders the immediate withdrawal of negative data that was not previously informed to the data subject, “in those cases in which the obligation or part of the obligation had ceased” (free translation). Furthermore, the reports for failure to pay financial obligations that amount to less than 20% of a monthly legal minimum wage, would only proceed once the data subject has been notified at least twice. 

Secondly, the draft bill establishes a new proceeding for rectifications requested by data subjects that have been victims of the “personal misrepresentation” crime (identity theft), and that “have been required to pay, as a consequence of the crime to which they are victims, a financial obligation” (free translation). In such cases, the data subject most present a “claim before the competent authority” and submit the “rectification request before the source, along with the relevant evidence”. The source must review the documents and, if it finds that the request is “duly justified”, it must modify the negative data and include “a disclaimer within the personal registry that says – victim of personal misrepresentation -”.  

The Superintendency of Industry and Commerce (SIC) has revealed that the increase in 122% of the claims on the violation of personal data protection is related to identity theft. According to the SIC, from 1 January to 26 June 2019, 1705 claims were reported, while during the same period of year 2018 there were only 767 reported claims.

The draft bill also modified the retention period of negative information in credit bureaus. For data that has “reference to outstanding periods, kind of payment collection, portfolio status and, in general, all data relating to failure to comply with a financial obligation”, the draft bill proposes that the retention period is equal to the outstanding period and for a maximum of two years “from the date that enforceable quotas are paid or the obligation has ceased” (free translation). In addition, the draft establishes a five-year period of statutory limitation regarding information on non-complied-with obligations, “from the date that the outstanding period begins”, except when judicial actions for debt collection have been initiated, “in which case the data must be withdrawn when the judicial proceeding comes to an end” (free translation). 

Finally, the draft bill proposes different mechanisms as part of its transitional regime, through which an “amnesty” would be provided for data subjects with respect to their negative information. The amnesty would operate in the following three scenarios: 1) when the data subjects’ obligation has ceased at the time that the law entries into force and “whose negative information has been retained in the databases for at least six (6) months from the date that the obligation has ceased”. In such cases the data subjects would have the right for their information to be withdrawn immediately; 2) data subjects would benefit from a retention period shortening when they have paid their financial obligation but their negative information has been retained in the databases for less than six months. The negative information would be then retained  “for the time necessary for such information to be retained six (6) months from the date that the obligation has ceased” and, regarding obligations with outstanding periods of less than six months, “the negative information will be retained for the same period as the outstanding period, from the date that the obligation has ceased”; and 3) data subjects that pay their financial obligation within six months following the entry into force of the law, would also benefit from a retaining period shortening on their negative information. Such information would be retained in the databases “for a maximum period of six (6) months, from the date that the obligation has ceased”. After this retention period, negative information must be “automatically withdrawn” from the databases. 

While some of the draft bill rapporteurs claim that it aims to increase access to credits (“democratization of credits”), some other actors from the financial sector that intervened in the legislative procedure criticize it and consider it to be counterproductive. Particularly, they argued that it could generate a decrease in credit access, given that information asymmetries between data subjects and users of credit bureaus would increase. The House of Representatives will come back on the draft bill debate this year on 16 March, when the sessions for the second period of the 2019/2020 legislature begin.