Colombia: Rappi and Banco Falabella fined for breach of Personal Data Protection Act

On 25 April 2019, the Colombian Personal Data Protection Office (SIC) sanctioned Banco Falabella and Rappi for not acknowledging people’s right to suppress their data when said companies use them for advertising purposes.

The sanction was not only monetary, but also involved measures for the eradication of this abusive behavior. Therefore, companies were also compelled to make available to holders a free and easily accessible mechanism to submit data deletion requests or revocations of granted authorizations, to timely respond to inquiries or complaints filed by individuals, and to implement a permanent monitoring mechanism regarding the effectiveness of the measures adopted, or to conduct an external audit focused on verifying the enforcement of the measures effective and appropriate for compliance.