Ley 81 de 2019, enforcement and sanctions

Article 34 creates the Consejo de Protección de Datos Personales as a consultative body drawing members from government ministries, regulators, the private sector, the bar and the banking industry, and article 35 gives it the power to advise the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI), recommend public policy, and evaluate submitted cases.

Article 36 empowers ANTAI to sanction a responsible party or database custodian found, on investigation of a complaint, to have infringed a data subject's rights, sets fines from B/.1,000 to B/.10,000 graduated by the infraction's gravity, and allows reconsideration before ANTAI's own Dirección and appeal to its director general.

Article 37 lets a data subject sue a responsible party in the ordinary courts for patrimonial or moral damage its unlawful processing caused, independent of ANTAI's administrative sanction.

Articles 38 to 41 classify infractions as minor, serious or very serious, minor being a late report to ANTAI, serious spanning consent failures, principle violations, breach of confidentiality, obstructing a data subject's rights, or failing to secure stored data, and very serious spanning bad faith collection, violating the sensitive data rules, ignoring an ANTAI suspension order, an unlawful international transfer, or repeating a serious infraction.

Article 43 sanctions a minor infraction with a citation, a serious infraction with a proportionate fine, and a very serious infraction with closure of the database's registries or suspension of the processing activity in addition to a fine, treats repetition of the same infraction within three years as recidivism, and requires every sanctioned fact to be documented so ANTAI can weigh gravity, repetition or recidivism.

Articles 45 and 46 give ANTAI its own budget line to carry out the Law and task the Órgano Ejecutivo with regulating the Law in coordination with ANTAI.