On June 26th, the Delegate for the Protection of Personal Data of the Superintendence of Industry and Commerce (the “SIC”) published External Circular Letter No. 01 of 2024, delimiting the powers that correspond to the entity in the enforcement of Law 2300 of 2023, known as the “Stop Disturbing” law.

In general terms, with regards to its jurisdiction on matters related with the abovementioned law, the SIC indicates that when it comes to the application of the financial habeas data regime (Law 1266 of 2008), enforcement corresponds to the Financial Superintendence, when it is an entity under its supervision, for all other entities SIC retains jurisdiction.

For matters related to contacting consumers for marketing purposes, SIC has jurisdiction if it involves a violation of both the consumers’ right to privacy and their right to habeas data as a whole; while where the autonomous right to privacy is involved, such enforcement falls outside of SIC’s jurisdiction. We will expand on this last issue below.

Hence, SIC summarized its jurisdiction in relation to Law 2300 of 2023 to events where the data subject alleges that:

a. An entity supervised by the SIC carries out debt collection:

• Through unauthorized channels or through more than one channel, whether it is contacting the debtor or its guarantors, co-debtors or joint debtors.
• To the debtor’s personal references.

b. With respect to providing marketing information, when a producer or supplier:

• Contacts the data subject through unauthorized channels or through more than one channel.
• Continues sending such information to the data subject after being informed that they person no longer wishes to receive it.
• Did not obtain from the data subject authorization to send this type of information or to feed databases for this purpose.
• Is conditioning the access to goods or services on the data subject granting, or not withdrawing, authorization to receive this type of information. 

Accordingly, the SIC considers that cases in which only the autonomous right to privacy is at issue, such as those related to the frequency and times of contact with data subjects, inquiries into the reasons for non-compliance with financial obligations, confirmations of monetary operations, savings or severance payments, information requested by the consumer or alerts about fraudulent transactions, fall outside its jurisdiction. However, SIC does not explain to whom such jurisdiction corresponds.

It is also important to note that the Circular Letter establishes that providers of goods and services covered by Law 2300 of 2023 must consult the Registry of Excluded Numbers (the “RNE” after its Spanish acronym) to identify whether the data subjects are registered in the RNE and which channels they have restricted, in order to avoid sending them marketing or commercial content through such channels.

Please note that, recently, the Regulatory Commission of Communications (“CRC” after its Spanish acronym) implemented the RNE. According to SIC, it is necessary for all providers of goods and services carrying out marketing and advertisement activities that involve sending communications to consumers to register as a company on the CRC website, which requires them to create a username and password and fill in some basic information, in order to access the list of consumers who are registered in the RNE to not be contacted for marketing and advertisement purposes.

SIC indicates that if a data subject registers within the RNE after giving an authorization to receive marketing or advertisement communications, this register must be understood as a revocation of such authorization.

Therefore, additional contact with a data subject registered in the RNE for marketing purposes, requires for the producer or supplier to re-obtain the data subject’s authorization after the registration in the RNE and only then may the company resume contact and send marketing information to the consumer.

For further information on the main provisions of Law 2300 of 2023, please refer to our Legal Update of May 30, 2023.

If you have any doubts or concerns about how this affects your business, please do not hesitate to contact us.

Author: Felipe Olaya