Google violates the personal data protection law in Colombia

The Industry and Trade Superintendence (SIC) recently “pulled Google LLC’s ears” (Google) in its role as national authority on personal data protection. Through Resolution No. 52593 from September 3rd of 2020, the SIC ordered Google to comply with Law 1581 from 2012 and its regulatory decrees.

It all began one year ago when the United States Federal Trade Commission (FTC) informed in a press release that Google and its subsidiary YouTube LLC, had been object of an investigation as they had gathered personal data from minors without obtaining prior parental consent. The SIC, in exercise of its legal faculties, decided to initiate an ex officio investigation to clarify the matter. Consequently, the SIC required Google to inform how they process personal data protection regarding children residing in Colombia.

Google responded to the SIC by affirming that, since it does not have a physical or legal presence in Colombia, the Colombian regime on personal data protection does not apply to it. However, Google informed that it does not process personal data without consent from its titleholders, and that in processing personal data from its users, it complies with very high standards set by the industry in which it operates. Particularly, in relation to users under the age of 13, Google expressed that it offers the YouTube Kids service, which offers different content than YouTube, and is especially aimed at entertaining kids. Among other things, because to be able to access this service, minors must have parental or guardian consent.

However, the SIC concluded something different. On one hand, Google does process personal data from users that reside within the Colombian territory, and therefore, it must comply with Law 1581 from 2012 and its regulations. And it does so, basically because it uses cookies in the provision of its services, particularly YouTube and YouTube Kids. Cookies are files created by a web site, which are installed in the user’s equipment or devices, in this case people who reside in Colombia, with the objective of collecting some of their personal data; for example, their geographic location, access keys, searches performed, video preferences, etc. As a consequence, the way in which the cookies work, determine the territorial scope of the personal data processing by Google, and the subsequent obligation to comply with the standards of the Colombian regime on personal data protection.

On the other hand, the SIC estimated that Google violates certain requirements of the Colombian personal data protection regime. Among them, Google does not fully comply with the duty to inform enshrined in article 12 of Law 1581 from 2012, and the personal data processing policies of YouTube and YouTube Kids do not meet all the requirements that these documents must comply with in accordance to article 13 of Decree 1377 from 2013. However, since what motivated the investigation was Google’s personal data processing related to minors, this matter constituted the focus of the SIC’s analysis. And to this respect, the SIC found that Google violates its obligation to obtain prior, express, and informed authorization from the parents or guardians of these minors to process their personal data. On the contrary, the SIC verified that in its terms and conditions, Google makes a disclaimer to be exempt from meeting this requirement, and what is even worse, it transfers the responsibility of obtaining this authorization to the minors using its services, as if they were the ones called to obtain it.

The SIC called on Google’s attention regarding the principle of accountability, to highlight that said principle becomes more demanding when dealing with the personal data of minors. Therefore, in observance thereof, Google, as entity responsible for personal data processing of minors in Colombia, bears the burden of ensuring that the legal representative of said minors authorizes processes their personal data in a prior, express, and informed way, as well as the burden of verifying that whoever granted said authorization, is in fact, the legal representative of the minor using its services. The important thing is that in its role as entity responsible for managing said data, Google must demonstrate that it obtained said authorization.

Consequently, the SIC ordered Google to follow the Colombian regime on personal data protection, stating the specific items that to date the company does not comply with, and giving it a deadline to meet each one of them. This administrative order does not constitute a sanction, although if not complied with it could lead to the fines foreseen in article 23 of Law 1581 from 2012. Google’s will to comply with said order remains to be seen, and especially, of desisting from its argument according to which the Colombian regime on personal data protection does not apply to it, which has probably been and will continue to be its line of defense before other personal data protection authorities, with the objective of unifying how it acts under the regime it believes it is subject to, and only follow it. In addition, this decision constitutes a valuable precedent for the SIC in relation to the applicability of the accountability principle, since in a giant the size of Google, the measures adopted to manage its users personal data must be useful and significant, and not just a hymn sung to a flag, as they currently are, judging by the clauses in the terms and conditions established for YouTube and YouTube Kids.

Tatiana López Romero
Associate Attorney in Litigation and Conflict Resolution
My Brand