Ley 1581 de 2012, Supervisory Authority and Sanctions

Article 19 designates the Superintendencia de Industria y Comercio, acting through its Delegatura para la Proteccion de Datos Personales, as the authority that oversees compliance with this law's principles, rights, guarantees and procedures.

Article 21 empowers the Superintendencia to investigate a violation on its own initiative or on complaint and order the measures needed to make the habeas data right effective, temporarily block a controller's processing where the evidence shows a real risk to a data subject's fundamental rights, promote and publicize data subjects' rights, instruct controllers and processors on adapting their operations to this law, issue the declaration of conformity for an international transfer, and administer the National Public Registry of Databases.

Article 22 requires the Superintendencia, once it establishes a violation, to apply the Codigo Contencioso Administrativo for anything this law does not itself regulate, and the sanctions this law provides are purely administrative, since it creates no criminal offense.

Article 23 lets the Superintendencia impose a fine of up to 2,000 current monthly legal minimum wages, suspend the processing activity for up to six months, or order the immediate and permanent closure of an operation that involves sensitive data, reserving these sanctions for private parties and referring a public authority's violation to the Procuraduria General de la Nacion instead.

Article 24 grades a sanction by the extent of the harm or danger, the economic benefit the infringer or a third party obtained, repeat infringement, resistance or obstruction of the investigation, defiance of the Superintendencia's orders, and the infringer's own acknowledgment of the violation before the sanction is imposed.