Decree 255 of February 23, 2022

This Decree modifies Section 7 of Chapter 25 of Title 2 of Section 2 of Book 2 of Decree 1074 of 2015, as it includes Binding Corporate Rules (hereinafter “BCR”) as standards for the certification of good practices in the protection of personal data and its transfer to third countries. Furthermore, it intends to establish an additional alternative, to facilitate the transfer of data between data Controllers, which are part of the same corporate group but are located in different countries.

According to Article 27 of Law 1581 of 2012, the Colombian Government had the obligation to regulate the use of Binding Corporate Rules; thus, a Decree Project was published last year for comments, and this final Decree was officially issued this las February 23, setting forth the minimum conditions that Binding Corporate Rules must comply with, including the guarantees and data protection mechanisms that must be offered, as well as the procedure for authorizing them.

Through this Decree, BCRs are defined as follows:

“Binding Corporate Rules are the policies, principles of good governance or codes of good business practices of mandatory compliance assumed by the data Controller, established in the Colombian territory, to carry out transfers or a set of transfers of personal data to a data Controller located outside the Colombian territory and that is part of the same corporate group”. (underline outside of original text)

However, according to the Scope of Application established in article 2.2.2.25.7.2 of the decree, these BCRs shall be binding and mandatory for the entire corporate group, and not only the Controller found in the national territory. Furthermore, it is stated that if BCRs are implemented, the whole corporate group will be jointly and severally liable for their compliance. Consequently, the Superintendence of Industry and Commerce, as the Colombian Data Protection Authority, may require, investigate and sanction the data Controller established in the Colombian territory for violations committed by any of the members of the corporate group.

As for the minimum requirements established for the BCRs, article 2.2.2.25.7.5 states that these must include the following:

1. "The structure and contact details of the corporate group and of each of its members to which the Binding Corporate Rules are mandatory.
2. The data transfers or series of data transfers, including the categories of personal data, the type of processing and its purposes, the type of data subjects affected, and the name of the third country or countries.
3. Their legally binding nature, for all the entities that make up the corporate group.
4. The application of the general principles on data protection established in Law 1581 of 2012 and its regulations.
5. The reference to the rights of the data subjects provided for in Law 1581 of 2012 and its regulatory decreed, as well as the effective means to exercise them.
6. The measures adopted to prevent transfers to other entities that do not belong to the corporate group. The foregoing, without prejudice to the provisions of Article 26 of Law 1581 of 2012.
7. The reference to the personnel in charge of compliance with the Binding Corporate Rules, as well as the supervision of training and the processing of complaints.
8. The mechanisms established within the corporate group to ensure that compliance with Binding Corporate Rules is verified. Such mechanisms shall include data protection audits and methods to ensure corrective actions to protect the rights of the data subjects.
9. The mechanisms in place for communicating and recording changes made to policies and for notifying such changes to the Superintendence of Industry and Commerce.
10. Relevant data protection training for personnel who have permanent or regular access to personal data.
11. The procedures for data subjects to submit queries or claims, and for these to be dealt within a timely manner in accordance with the provisions of Law 1581 of 2012.
12. The adoption of Accountability measures to verify that useful, timely, relevant and efficient measures have been implemented to comply with the Binding Corporate Rules and the provisions of this decree.
13. The specifications or additional requirements made by the Superintendence of Industry and Commerce based on the previous paragraphs".

In addition to this, the BCRs that are implemented must include mechanisms to ensure that the personal data is:

1. Processed in a lawful, fair, and transparent manner.
2. Collected for specified, explicit and legitimate purposes, and not further processed in a way incompatible with those purposes.
3. Adequate, relevant and limited to the minimum necessary in relation to the purposes for which it is processed.
4. Accurate and kept up to date; meaning that all reasonable steps shall be taken to ensure that inaccurate personal data are promptly deleted or rectified.
5. Kept in a form which allows the identification of the data subject for no longer than is necessary.
6. Processed under the control of the Controller, who, for each processing operation, shall ensure and demonstrate compliance with the provisions of the Decree.

In order to implement the above, the Decree established that corporate groups must submit their BCRs before the Superintendence of Industry and Commerce for approval, after they have been accepted by the corresponding direction organ within the group. According to the Decree, the Superintendence will approve BCRs that comply with the aforementioned requirements, along with other applicable obligations set forth in local law, especially regarding the processing of Special Categories of personal data.

Please note that before this, the Superintendence of Industry and Commerce must publish in its web page all the specifications to be contained in the Binding Corporate Rules, along with the date from which interested parties may submit their applications for review, which has not occurred yet.

The full Decree is available in the following link: https://dapre.presidencia.gov.co/normativa/normativa/DECRETO%20255%20DEL%2023%20DE%20FEBRERO%20DE%202022.pdf (only in Spanish)