The Colombian Constitution protects the right to privacy as a fundamental human right. Article 15 provides that:
Every individual has the right to personal and family privacy and to his or her good reputation while the state will respect them and must ensure they are respected. Similarly, individuals have the right to know, update, and rectify information gathered about them in data banks and in the records of public and private entities. Freedom and the other guarantees established by the Constitution will be respected in the collection, processing, and transfer of data.
Correspondence and other forms of private communication are inviolable. They may only be intercepted or recorded pursuant to a court order, pursuant to formalities established by law.
For tax or legal purposes and for cases of inspection, supervision, and state intervention, the disclosure] of accounting records and other private documents may be required within the limits provided by law.
Because of terrorism concerns, the Colombian Government is currently working to amend Article 15. It recently sent to Congress a bill[972] that would allow administrative authorities to restrict this right in order to intercept or record correspondence and other forms of private communicationwithout court order. This restriction will only apply to terrorism cases.
There is no comprehensive data protection legal framework for the private sector. Sectoral laws include protections for medical records[973] and the inviolability of correspondence and other forms of private communication.[974] The Criminal Code[975] establishes penalties for the following offenses: theillicit violation of communications[976], and the offer, sale or purchase of suitable instrument to intercept private communications.[977]
There is no data protection law. However, some legislative work has been done on the protection of personal data with a view to having a full range of legislation that is compatible with constitutional and international data protection principles.[978]
"Habeas data"[979] is also included in the Constitution. From 1992, the Constitutional Court held in more than ninety cases that personal data (any information relating to an identifiable person) collected from individuals must be:
Processed fairly and lawfully; and collected and processed for specified, explicit and legitimate purposes. It is important to note that individual consent must be obtained before, or at the time of collection, and whenever a new use is identified for the personal information; adequate, relevant, and not excessive in relation to the purposes for which they are collected or further processed. The controller of the data must not process any personal information in a way that has not been previously authorized; only collected to the extent necessary for the purposes identified; accurate and updated permanently; and kept in a form which permits identification of individuals for no longer that is necessary.
In addition, the data controller must provide customers with the right of access to such information, and the right to correct any inaccuracies in the data. Once collected, personal data may not be processed unless the customer has unambiguously given his or her consent.
Even with the adoption of legal rules and case law on data protection, violations of privacy remain a concern. Colombian legislation has not kept up with the technology, leaving big gaps in protection. Unlike some other countries, Colombia does not have law that directly tackles Internet privacy.
In April 2003, the press revealed that a US company, ChoicePoint, had allegedly collected personal data from Colombia government agencies or private companies and sold them to US government agencies and law enforcement. ChoicePoint currently offers to sell the following information about Colombian people: "national registry files of all adult Colombians, including date and place of birth, gender, parentage, physical description, marital status, registration data, registration and passport numbers, as well as registered profession."[980]
Article 74 of the Constitution states that "Every person has a right to access public documents except in cases established by law".
The main law regulating the access to public documents is Law No. 57 of July 5, 1985. Its Article 12, for example, grants every person the right to access and consult the documents that are held by the government, and to get a copy of them. However, people cannot consult or take a copy of documents that by law are considered exempted from disclosure (confidential information, medical records or documents that could have an impact on national security). The legal exemption is not effective thirty years after a document has been expedited. After that, the document acquires historical character and can be consulted by any citizen.[981]
A key principle of the recent General Law of Public Archives[982] is entitled "Administration and access". According to this law, the administration of public files is a duty of the State and a right of the citizens the get access to them.
Colombia signed the American Convention on Human Rights (the Pact of San Jose, Costa Rica) and the United Nations International Covenant on Civil and Political Rights.