On October 7, 2011, the Constitutional Court of Colombia approved a landmark omnibus data protection law. … Some highlights include:
- With certain exceptions, the law prohibits the processing of personal data without the data subject’s prior consent. When the personal data are sensitive data (e.g., health data), the consent must take the form of an explicit authorization.
- The law permits cross-border transfers of personal data to countries that lack adequate data protection laws only in specified circumstances, such as (1) when the data subject has given express and unequivocal consent for the transfer (2) the transfer is necessary for the performance of a contract between the data subject and the data controller, or (3) with the approval of the Superintendence of Industry and Commerce.
- The processing of children’s personal data is generally prohibited.
- Data subjects have access rights.
Read more on Hunton & Williams Privacy and Information Security Law Blog.