Superintendencia de Industria y Comercio

The personal data protection regime of Colombia, analyzed through the theory of justice proposed by Rawls (1971), is differential with regard to the exercise of the habeas data right by children and adolescents. Having said that, it is appropriate to begin by specifying that the Colombian Political Constitution recognizes people's ability to know, update and rectify the information that has been collected about them in a database or file (Art. 15). On another hand, Law 1581 of 2012, which as a statutory norm forms part of the Colombian constitutionality block and, therefore, has a higher hierarchy than other legal system norms, defines under the concept of "Data Subject” the "natural person whose personal data is subject to treatment "(Art. 3, Lit. f), also establishes the procedure for consultation and complaint so that "the Data Subjects or their successors in title" exercise the powers that form part of the habeas data right (Art. 14 and 15). In this sense, it would be understood that minors, as persons, are legitimized for the direct exercise of their habeas data right.

The previous assessment would be correct when dealing with minors with enough psychological maturity to make their decisions, especially when there are regulations in the legal system that enable some of them to make their decisions susceptible to imputability (for example: the possibility of contracting marriage and the system of criminal responsibility for adolescents, which apply after the age of fourteen), however, it is worth remembering that it would also shelter minors who do not have such aptitude, which would lead to the lack of protection of the personal data of said individuals.

However, the Decree 1074 of 2015 establishes that "[t]he rights of children or adolescents shall be exercised by the persons empowered to represent them". Thus, although the powers that conform the habeas data right can be exercised directly by any individual of the human species regardless of their age, the regulatory legislator decided to modulate it by legitimizing only their representatives and, consequently, proscribing the possibility that minors grant their consent for the processing of their personal data and directly exercise their right through the procedures of consultation and complaint.

In this order of ideas, the legislator recognizes the differences that exist between minors (boys, girls, adolescents) and adults, which are a consequence of the development process of understanding and willingness to take responsible decisions as agents, and in turn, make the former less advantaged than the latter because their degree of self-determination is inferior. Faced with such inequality, the legal system has a tool to protect minors, which is the application of the “maximin” principle, enunciated by Rawls (1971), according to which «when the greatest potential of the benefits of the most advantaged is meaningful, there will surely be a way to improve the situation of the least advantaged» (page 175). Indeed, legitimizing representatives for the exercise of the habeas data right of minors tends to protect these subjects from abuses in the processing of their personal data.

That being said, it is necessary to address the reflection on the responsibility that assists the representatives to exercise the rights of their protected subjects. Children and adolescents, as mentioned, because they are minors, have limited ability to act. For this reason, it is evident that many of their actions must be carried out by those who hold their legal representation. However, it is necessary to clarify that this does not imply in any way that the legal status of the representative has an absolute or unconditional priority over the child, since the best interests of the latter can, at times, confer rights related to the protection of data that can cancel the rights of their representatives. In this regard, the Superintendence of Industry and Commerce, through the Concept 13-232774-2 of November 19, 2013, said that it is possible for a higher education institution to request authorization for the processing of personal data directly to the Data Subject, even if this is a minor, because it considered that education is a higher interest which could be limited if universities are not allowed to establish direct contact with adolescents who attend their institutions.

Nevertheless, the need for representation does not mean that minors should not be consulted for the treatment of their personal data after a certain age. If the treatment of the minor's data began with the consent of his representative, the child in question, upon reaching the majority age, may revoke that consent. If, on the contrary, you want the treatment to continue, the interested party must give his explicit consent when required. In this regard, it should be remembered that the habeas data right belongs to the minor and not to his representative, who its limited to exercise that right, always for the benefit of the minor.

Likewise, it is clear that minors gradually acquire the ability to contribute to the decisions that affect them, therefore, as they grow they should be regularly consulted about the exercise of their rights, including those related to the protection of personal data. This obligation of consultation means that the representative has to have the minor’s point of view when making decisions such as the publication of his image, inform his geolocation or simply share information that may be associated with him, which is common in today's society due to the rapid expansion of social networks.

On the other hand, with the child's notorious participation in activities that involve the processing of their personal data, such as social networks, it is necessary that the regulatory legislator reconsiders the paternalistic model by virtue of which the exercise of the habeas data right from children and adolescents are understood to be exercised by their representatives. In countries such as Spain, the exercise of the habeas data right is determined by the level of maturity of the child, which it’s presumed to be reached at the age of fourteen; in fact, article 13.1 of the Royal Decree 1720 of 2007 «by which it is approved the development of the regulation of the organic law 15 of 1999 that protects personal data» indicates that having completed fourteen years authorizes the minor to lend validly authorization for their personal data to be processed, while children under that age always need the consent of their legal representatives.

In this regard, it is necessary to implement a model based on the autonomy of the subject and, thus, it is important to not only decrease the age that legitimizes the exercise of the habeas data right, but also to adopt public policies for the education of children about the importance and value of their personal information and the consequences of their improper use. While the current paternalistic model requires that parents, guardians, educators and authorities always promote the best interests of the child, even against his will, based on the lack or insufficiency of maturity of the child or adolescent, the model based on autonomy would require, on the contrary, to respect whenever possible the will of the minor to define the matters that concern him. 

It is not an easy process, because the national legislation related to the personal data protection regime is under construction and it’s just facing the challenges that came with the rise of new information technologies. Also, it may require a deep analysis of the subject’s psychology. However, the implementation of simple actions such as instructing the representatives to consult the will of the minor according to their degree of maturity represents an important step and stands as a guarantee of equality.

Cesar Estibeth Perilla González

Bibliography

Rawls, J. (1971). A theory of justice. México: Fondo de Cultura Económica .